WP Landing Page <= 0.9.3 - 任意の投稿メタ更新へのクロスサイトリクエストフォージェリ

The primary impact of this CSRF vulnerability lies in the ability of an attacker to modify post meta data without proper authentication. This could involve altering page content, changing settings, or injecting malicious code. A successful attack requires the attacker to trick a site administrator into clicking a specially crafted link or visiting a malicious webpage. The blast radius is limited to the affected WordPress site and its associated data, but the potential for defacement or data manipulation is significant. This vulnerability is similar to other CSRF flaws where user actions are performed without proper authorization.

WordPress websites utilizing the WP Landing Page plugin, particularly those with administrative access that could be tricked into clicking malicious links, are at risk. Shared hosting environments where multiple websites share the same server resources are also potentially vulnerable, as a compromise of one site could lead to attacks against others.

• wordpress / composer / npm:

grep -r 'wplp_api_update_text' /var/www/html/wp-content/plugins/wp-landing-page/

• wordpress / composer / npm:

wp plugin list --status=all | grep 'wp-landing-page'

• wordpress / composer / npm:

wp plugin update wp-landing-page --all

1. 2025-12-06Disclosure

   disclosure

1. 予約済み2025-11-24
2. 公開日2025-12-06
3. 更新日2026-04-08
4. EPSS 更新日2026-03-23

The immediate mitigation for CVE-2025-13629 is to upgrade to a patched version of the WP Landing Page plugin as soon as it becomes available. Until then, implement a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Alternatively, consider using a WordPress security plugin that provides CSRF protection. Carefully review any suspicious URLs or requests before clicking on them, and educate administrators about the risks of CSRF attacks. After applying a WAF rule or upgrading the plugin, verify the mitigation by attempting to trigger the vulnerable endpoint with a forged request and confirming that it is blocked or fails.