CVE-2025-13629: CSRF in WP Landing Page WordPress Plugin

The primary impact of this CSRF vulnerability lies in the ability of an attacker to modify post meta data without proper authentication. This could involve altering page content, changing settings, or injecting malicious code. A successful attack requires the attacker to trick a site administrator into clicking a specially crafted link or visiting a malicious webpage. The blast radius is limited to the affected WordPress site and its associated data, but the potential for defacement or data manipulation is significant. This vulnerability is similar to other CSRF flaws where user actions are performed without proper authorization.

1. Reserved2025-11-24
2. Published2025-12-06
3. Modified2026-04-08
4. EPSS updated2026-03-23

The immediate mitigation for CVE-2025-13629 is to upgrade to a patched version of the WP Landing Page plugin as soon as it becomes available. Until then, implement a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Alternatively, consider using a WordPress security plugin that provides CSRF protection. Carefully review any suspicious URLs or requests before clicking on them, and educate administrators about the risks of CSRF attacks. After applying a WAF rule or upgrading the plugin, verify the mitigation by attempting to trigger the vulnerable endpoint with a forged request and confirming that it is blocked or fails.