CVE-2025-13362: CSRF in Norby AI WordPress Plugin

The primary impact of this CSRF vulnerability is the ability for an attacker to modify the Norby AI plugin's configuration without authentication. By crafting a malicious request and tricking a site administrator into clicking a link or visiting a compromised page, an attacker can alter plugin settings. This could involve injecting arbitrary JavaScript code, potentially leading to account takeover, data theft, or defacement of the WordPress site. The blast radius extends to any site utilizing the vulnerable Norby AI plugin, particularly those with administrative access that could be socially engineered into executing the malicious request.

1. Reserved2025-11-18
2. Published2025-12-05
3. Modified2026-04-08
4. EPSS updated2026-03-23

The recommended mitigation is to immediately upgrade the Norby AI plugin to a version that addresses this CSRF vulnerability. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting access to the plugin's settings page. This can be achieved through role-based access control (RBAC) plugins or custom code that limits access to authorized administrators only. While not a complete solution, this can reduce the attack surface. After upgrading, verify the fix by attempting to access the plugin's settings page from a different browser session without being logged in as an administrator; the page should redirect or display an access denied error.