WP Admin Microblog <= 3.1.1 - Cross-Site Request Forgery pour la création de messages

The primary impact of this CSRF vulnerability is the potential for unauthorized actions to be performed on a WordPress site with administrator privileges. An attacker could craft a malicious link that, when clicked by an administrator, would trigger the sending of a message or other administrative actions without the administrator's knowledge or consent. This could be used to spread misinformation, compromise the site's reputation, or even gain further access to the system if the messages contain malicious content or links. The blast radius is limited to the scope of actions available through the WP Admin Microblog plugin.

Websites utilizing the WP Admin Microblog plugin, particularly those with administrator accounts that frequently click on links from untrusted sources, are at risk. Shared hosting environments where multiple WordPress sites share the same server resources are also potentially vulnerable, as a compromise of one site could lead to attacks against others.

• wordpress / composer / npm:

grep -r 'wp-admin-microblog' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list | grep "WP Admin Microblog"

• wordpress / composer / npm:

curl -I https://example.com/wp-admin-microblog/ | grep -i 'referer'

1. 2025-11-18Disclosure

   disclosure

1. Réservé2025-10-24
2. Publiée2025-11-18
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-23

The immediate mitigation for CVE-2025-12173 is to upgrade the WP Admin Microblog plugin to a version that addresses the missing or incorrect nonce validation. If upgrading is not immediately possible due to compatibility issues or testing requirements, consider temporarily restricting administrator access to the 'wp-admin-microblog' page. While not a complete solution, this can reduce the attack surface. Monitor WordPress access logs for suspicious activity, particularly requests originating from unfamiliar sources targeting the plugin's administrative endpoints. After upgrading, confirm the fix by attempting to trigger a message send action via a crafted CSRF request and verifying that it is blocked.