CVE-2025-13521: CSRF in WP Status Notifier WordPress Plugin

An attacker exploiting this CSRF vulnerability could potentially alter the configuration of the WP Status Notifier plugin without authentication. This could involve changing notification settings, API keys, or other sensitive parameters. Depending on the plugin's functionality, this could lead to unauthorized access to data, modification of site behavior, or even denial of service. The impact is amplified if the plugin interacts with external services or APIs, as an attacker could potentially leverage the compromised plugin to launch attacks against those services. While the plugin itself might not be directly exploitable for broader system compromise, it represents a significant risk to WordPress site integrity and data security.

1. Reserved2025-11-21
2. Published2026-01-07
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-13521 is to upgrade to a patched version of the WP Status Notifier plugin as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. Restrict access to the plugin's settings page using WordPress's role-based access control features, limiting access to administrators only. Carefully review any links or URLs before clicking, especially those received via email or from untrusted sources. Implement a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Regularly monitor WordPress logs for suspicious activity related to the plugin.