CVE-2025-9209: 
WordPress vulnerability analysis and mitigation

CVE-2025-9209 is an Authentication Bypass vulnerability in the RestroPress – Online Food Ordering System plugin for WordPress, affecting versions 3.0.0 through 3.1.9.2. The flaw allows unauthenticated attackers to forge JWT tokens for any user, including administrators, by exploiting the plugin's exposure of private user tokens and API data via the /wp-json/wp/v2/users REST API endpoint. It was disclosed on October 3, 2025, with Wordfence as the CNA. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, Feedly).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the plugin incorrectly exposes user private tokens and JWT-related API data through the publicly accessible WordPress REST API endpoint /wp-json/wp/v2/users without proper access controls (Wordfence). An unauthenticated attacker can query this endpoint to retrieve private tokens for any registered user, then use those tokens to forge valid JWT authentication tokens and impersonate that user — including site administrators. No prior authentication or special privileges are required, and the attack is fully remote with low complexity.

Successful exploitation grants an attacker full administrative access to the affected WordPress site, enabling them to steal sensitive user data, modify site content, install malicious plugins or backdoors, and perform any action available to an administrator (Wordfence, Feedly). The confidentiality, integrity, and availability of the entire WordPress installation are all rated HIGH, reflecting the potential for complete site compromise. Lateral movement to connected systems or databases is also possible if the compromised admin account has broader infrastructure access.

A public proof-of-concept exploit has been published on GitHub (GitHub PoC) and referenced on Sploitus and Vulners, indicating the vulnerability has been weaponized beyond initial disclosure. A Nuclei detection template has also been added to the ProjectDiscovery nuclei-templates repository, enabling automated scanning (Nuclei Templates). The EPSS score is approximately 0.22%, and there is no current listing in the CISA KEV catalog. No specific threat actor attribution has been reported, and active in-the-wild exploitation has not been confirmed as of the latest available data (Feedly).

1. Reconnaissance: Identify WordPress sites running the RestroPress plugin (versions 3.0.0–3.1.9.2) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:/wp-content/plugins/restropress).
2. Enumerate users via REST API: Send an unauthenticated GET request to https://target.com/wp-json/wp/v2/users to retrieve a list of registered users along with their exposed private tokens and JWT-related API data.
3. Extract private tokens: Parse the JSON response to identify private token fields associated with target accounts, particularly administrator-level users.
4. Forge JWT token: Use the extracted private token/secret to craft a valid JWT authentication token for the target user, following the JWT signing algorithm used by the plugin.
5. Authenticate as administrator: Submit the forged JWT token in subsequent requests (e.g., via the Authorization: Bearer <token> header or cookie) to authenticate as the target user.
6. Achieve full site compromise: With administrator access, install malicious plugins, create backdoor accounts, exfiltrate user data, or modify site content (Wordfence, GitHub PoC).

• Network: Unusual or high-volume unauthenticated GET requests to /wp-json/wp/v2/users from external IP addresses; requests with ?context=edit parameter to retrieve additional private fields.
• Logs: WordPress access logs showing repeated REST API calls to /wp-json/wp/v2/users followed by authenticated admin actions from the same or different IP; authentication events for admin accounts from unexpected IP addresses or geolocations.
• File System: Newly installed or modified plugins not authorized by site administrators; presence of web shells or unfamiliar PHP files in the WordPress uploads or plugins directories.
• User Accounts: Unexpected new administrator accounts created; password or email changes on existing admin accounts; unfamiliar API keys or application passwords added to user profiles.
• Process: Unusual outbound connections from the web server process to external hosts following REST API enumeration activity (Wordfence).

The primary remediation is to update the RestroPress plugin to a version later than 3.1.9.2, which addresses the improper exposure of private tokens via the REST API (Wordfence, WordPress Plugin Page). If an immediate update is not possible, consider temporarily deactivating the plugin to eliminate the attack surface. Additionally, administrators should audit all user accounts and access logs, reset authentication tokens for all users, and monitor for suspicious authentication activity. Restricting access to the WordPress REST API for unauthenticated users via a security plugin or server-level configuration can serve as a defense-in-depth measure.

Wordfence included CVE-2025-9209 in their weekly WordPress vulnerability report for the period of September 29 – October 5, 2025, highlighting it as a critical authentication bypass (Wordfence Blog). The vulnerability was also noted on Bluesky by security community members following the addition of a Nuclei detection template. No major vendor statements beyond Wordfence's advisory have been identified.