CVE-2025-9884: 
WordPress vulnerability analysis and mitigation

CVE-2025-9884 is a Cross-Site Request Forgery (CSRF) vulnerability in the Mobile Site Redirect plugin for WordPress, affecting all versions up to and including 1.2.1. Due to missing or incorrect nonce validation, unauthenticated attackers can trick a site administrator into performing actions that update plugin settings and inject malicious web scripts. The vulnerability was published on October 3, 2025, and was reported by Wordfence. It carries a CVSS v3.1 base score of 6.1 (Medium) (Wordfence, Red Hat).

The root cause is classified as CWE-352 (Cross-Site Request Forgery), stemming from missing or incorrect nonce validation in the plugin's admin function located in mobired_admin.php at line 27. Because the affected function does not verify the authenticity of incoming requests, an attacker can craft a forged HTTP request that, when executed in the context of an authenticated administrator's browser session, modifies plugin settings or injects malicious scripts. Exploitation requires social engineering — the attacker must trick a logged-in WordPress administrator into clicking a malicious link or visiting a crafted page (Wordfence, Plugin Source).

Successful exploitation allows an attacker to update plugin settings and inject malicious web scripts (Stored XSS via CSRF) into the WordPress site, affecting both confidentiality and integrity. The changed scope (S:C) indicates that injected scripts can execute in victims' browsers beyond the plugin's own context, potentially enabling session hijacking, credential theft, or further malicious redirects targeting mobile site visitors. Availability is not directly impacted, but the combination of settings manipulation and script injection could significantly degrade site trustworthiness and user safety (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-9884. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Wordfence, Red Hat).

1. Reconnaissance: Identify WordPress sites using the Mobile Site Redirect plugin (version ≤ 1.2.1) via passive enumeration (e.g., checking plugin directories or HTTP response headers).
2. Craft malicious request: Create a forged HTML form or link that submits a POST request to the WordPress admin endpoint handling Mobile Site Redirect settings (targeting the vulnerable function in mobired_admin.php), including a malicious script payload in the settings fields.
3. Social engineering: Deliver the crafted link or page to a logged-in WordPress administrator via phishing email, comment, or other communication channel, inducing them to click the link or load the page.
4. CSRF execution: When the administrator's browser loads the attacker-controlled page, it automatically submits the forged request with the administrator's session cookies, bypassing nonce validation and updating plugin settings with the injected payload.
5. Payload activation: The injected malicious script is stored in plugin settings and subsequently executed in the browsers of site visitors (or the administrator), enabling session hijacking, credential theft, or malicious redirects (Wordfence, Plugin Source).

• Logs: WordPress admin access logs showing unexpected POST requests to plugin settings pages (e.g., wp-admin/options-general.php?page=mobile-site-redirect) from unusual referrers or at unusual times.
• File System / Database: Unexpected or obfuscated JavaScript payloads stored in the Mobile Site Redirect plugin settings within the WordPress wp_options table.
• Network: Outbound connections from site visitors' browsers to unknown external domains following visits to the affected WordPress site, potentially indicating injected script execution.
• Process/Behavior: Mobile site visitors being redirected to unexpected or malicious URLs not configured by the site administrator.

WordPress site administrators should update the Mobile Site Redirect plugin to a version beyond 1.2.1 that includes proper nonce validation, if a patched version has been released by the vendor (webdevabq). If no patch is available, the recommended workaround is to deactivate and remove the plugin until a fix is issued. Additionally, administrators should review current plugin settings for any unauthorized changes or injected scripts, and apply general WordPress hardening practices such as limiting admin account exposure and using security plugins that detect CSRF anomalies (Wordfence, WordPress Plugin Page).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability report covering September 29 – October 5, 2025, highlighting it among other plugin-level CSRF issues. No significant independent researcher commentary, vendor statements beyond the Wordfence advisory, or notable media coverage has been identified for this specific CVE (Wordfence Blog).