CVE-2025-7688: 
WordPress vulnerability analysis and mitigation

CVE-2025-7688 is a Cross-Site Request Forgery (CSRF) vulnerability in the Add User Meta plugin for WordPress, affecting all versions up to and including 1.0.1. Due to missing or incorrect nonce validation on the add-user-meta page, unauthenticated attackers can trick a logged-in administrator into performing unauthorized actions, including updating plugin settings and injecting malicious web scripts (Stored XSS via CSRF). The vulnerability was published on August 15, 2025, and assigned a CVSS v3.1 base score of 6.1 (Medium) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-352 (Cross-Site Request Forgery), stemming from the absence of proper nonce validation on the plugin's add-user-meta administrative page. WordPress plugins are expected to verify a nonce (a one-time cryptographic token) on all state-changing requests; the Add User Meta plugin fails to do so, allowing any forged HTTP request originating from a victim administrator's browser to be accepted as legitimate. An attacker crafts a malicious HTML page or link that, when visited by an authenticated WordPress administrator, silently submits a forged POST request to the vulnerable endpoint — enabling arbitrary settings changes and injection of persistent malicious scripts into user meta fields (Wordfence, WordPress Plugin Source).

Successful exploitation allows an attacker to update plugin settings and inject persistent malicious JavaScript into WordPress user meta fields, effectively achieving Stored Cross-Site Scripting (XSS) through the CSRF vector. This can lead to session hijacking, credential theft, unauthorized administrative actions, or further compromise of the WordPress site and its users. The confidentiality and integrity of site data are both at risk, though availability is not directly impacted (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-7688 as of the time of writing. The vulnerability requires social engineering — an attacker must trick a site administrator into clicking a malicious link or visiting a crafted page while authenticated. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites using the Add User Meta plugin (version ≤ 1.0.1) via passive enumeration (e.g., checking /wp-content/plugins/add-user-meta/ path accessibility or using tools like WPScan).
2. Craft malicious request: Create an HTML page or form that auto-submits a POST request to the target site's add-user-meta admin page (e.g., https://target.com/wp-admin/admin.php?page=add-user-meta) with attacker-controlled parameters, including a malicious script payload in the user meta value field.
3. Deliver the payload: Send the malicious link or embed the auto-submitting form in an email, forum post, or other medium likely to be accessed by a WordPress administrator who is currently logged in.
4. Trigger CSRF: When the administrator visits the attacker's page, their browser automatically submits the forged request with their valid session cookies, bypassing authentication checks due to the missing nonce validation.
5. Achieve persistent XSS: The injected malicious script is stored in WordPress user meta fields and executes in the context of the admin panel or affected user profiles, enabling session theft, credential harvesting, or further site compromise (Wordfence).

• Logs: WordPress access logs showing unexpected POST requests to /wp-admin/admin.php?page=add-user-meta from unusual referrer URLs or external domains.
• Database: Unexpected or suspicious JavaScript content (e.g., <script> tags, encoded payloads) stored in the WordPress wp_usermeta table under meta keys managed by the Add User Meta plugin.
• Network: Outbound connections from the WordPress server or administrator browsers to unknown external domains following admin panel interactions, potentially indicating script-based data exfiltration.
• File System: No direct file system artifacts expected, as this is a database-stored XSS via CSRF; however, review plugin files for unauthorized modifications to plugin.php (Wordfence).

WordPress site administrators should immediately update the Add User Meta plugin to a version beyond 1.0.1 if a patched release is available, or deactivate and remove the plugin until a fix is confirmed. As a general workaround, administrators should avoid clicking unsolicited links while logged into the WordPress admin panel and consider using a Web Application Firewall (WAF) with CSRF protection rules. Wordfence users with active firewall rules may have additional protection against exploitation attempts (Wordfence, WordPress Plugin Page).

The vulnerability was discovered and disclosed by Wordfence, which serves as the primary authoritative source for technical details. Coverage has been picked up by automated vulnerability aggregators including VulDB, Vulners, and CIRCL, as well as security news aggregators such as Red Packet Security. No notable independent researcher commentary or significant social media discussion has been identified beyond standard CVE publication notices (Wordfence).