AuthorSure <= 2.3 - Cross-Site Request Forgery zu Stored Cross-Site Scripting

The primary impact of CVE-2025-13134 is the potential for attackers to inject malicious scripts into a WordPress website. By leveraging CSRF, an attacker can craft a forged request that, when executed by a logged-in administrator, will modify AuthorSure plugin settings. This could involve injecting arbitrary JavaScript code, leading to session hijacking, defacement of the website, or redirection to malicious sites. The blast radius extends to any user visiting the compromised website, as they could be exposed to the injected scripts. Successful exploitation requires social engineering to convince an administrator to click a malicious link or visit a crafted page.

WordPress websites utilizing the AuthorSure plugin, particularly those with shared hosting environments where multiple websites share the same server infrastructure, are at increased risk. Websites with less stringent administrator training or security practices are also more vulnerable to social engineering attacks.

• wordpress / plugin: Use wp-cli to check the installed version of AuthorSure:

wp plugin list --status=active | grep AuthorSure

• wordpress / plugin: Examine the authorsure plugin files for missing or incorrect nonce validation. Search for instances where user input is directly used in HTTP requests without proper verification. • generic web: Monitor access logs for suspicious requests targeting the authorsure page, particularly those originating from unusual IP addresses or user agents. • generic web: Check response headers for unexpected JavaScript code or redirects.

1. 2025-11-21Disclosure

   disclosure

1. Reserviert2025-11-13
2. Veröffentlicht2025-11-21
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The most effective mitigation for CVE-2025-13134 is to immediately upgrade the AuthorSure plugin to version 2.4 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the 'authorsure' page that lack proper nonce validation. Additionally, educate administrators about the risks of clicking on suspicious links and performing actions without verifying their authenticity. Regularly review WordPress user permissions to ensure only necessary users have administrative access.