Cross-Site Request Forgery Vulnerability in Insert Headers And Footers Plugin for WordPress

CVE-2025-2111

What is CVE-2025-2111?

The Insert Headers And Footers plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF), enabling unauthenticated attackers to manipulate site options without proper authorization. This vulnerability arises from inadequate nonce validation in the 'custom_plugin_set_option' function, allowing attackers to send forged requests that could alter settings, such as granting administrative roles for user registration. Exploiting this flaw requires the 'WPBRIGADE_SDK__DEV_MODE' constant to be set to 'true', facilitating unauthorized access to the WordPress site if a site administrator is tricked into initiating an action.

References