IndieAuth Plugin up to 4.5.4 on WordPress wp-login.php?action=indieauth login_form_indieauth cross-site request forgery

Summaryinfo

A vulnerability, which was classified as problematic, was found in IndieAuth Plugin up to 4.5.4 on WordPress. Impacted is the function login_form_indieauth of the file /wp-login.php?action=indieauth. The manipulation results in cross-site request forgery. This vulnerability is known as CVE-2025-12028. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in IndieAuth Plugin up to 4.5.4 on WordPress. It has been classified as problematic. Affected is the function login_form_indieauth of the file /wp-login.php?action=indieauth. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. CWE is classifying the issue as CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This is going to have an impact on integrity. CVE summarizes:

The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for unauthenticated attackers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications via a forged request granted they can trick a user into performing an action such as clicking on a link or visiting a malicious page while logged in. The attacker can then exchange the stolen authorization code for an access token, effectively taking over the victim's account with the granted scopes (create, update, delete).

The advisory is available at wordfence.com. This vulnerability is traded as CVE-2025-12028. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Name

• IndieAuth Plugin

Version

• 4.5.0
• 4.5.1
• 4.5.2
• 4.5.3
• 4.5.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion