Quran Gateway <= 1.5 - Cross-Site Request Forgery zu Einstellungen-Update

An attacker exploiting this CSRF vulnerability could trick a WordPress administrator into unknowingly executing actions that modify the Quran Gateway plugin's configuration. This could involve altering the plugin's appearance, functionality, or even injecting malicious code through configuration options. While the direct impact might seem limited to the plugin itself, a compromised plugin can be a stepping stone for further attacks on the WordPress site, potentially leading to data breaches or complete site takeover. The ability to modify display settings could also be used to deface the website or redirect users to malicious sites.

WordPress websites utilizing the Quran Gateway plugin, particularly those with multiple administrators or shared hosting environments, are at increased risk. Sites with outdated plugin versions and inadequate security practices are especially vulnerable.

• wordpress / composer / npm:

grep -r "quran_gateway_options" /var/www/html/wp-content/plugins/

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=quran_gateway_options | grep -i "csrf token"

1. 2025-12-20Disclosure

   disclosure

1. Reserviert2025-12-05
2. Veröffentlicht2025-12-20
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-14164 is to upgrade the Quran Gateway plugin to a version that includes the necessary nonce validation. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block suspicious requests targeting the qurangatewayoptions function. Additionally, carefully review any unexpected changes to the plugin's settings and restrict administrator access to only those who require it. After upgrading, confirm the fix by attempting a CSRF attack against the plugin's settings page and verifying that the request is rejected.