{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13629", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-24T21:40:10.616Z", "datePublished": "2025-12-06T05:49:26.481Z", "dateUpdated": "2026-04-08T16:49:14.832Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:14.832Z"}, "affected": [{"vendor": "xbenx", "product": "WP Landing Page", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.9.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Landing Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the 'wplp_api_update_text' function. This makes it possible for unauthenticated attackers to update arbitrary post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "WP Landing Page <= 0.9.3 - Cross-Site Request Forgery to Arbitrary Post Meta Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/43d8576b-e6ad-4e0a-b99f-948ba36f53ff?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-landing-page/trunk/includes/wplp-api.php#L14"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-landing-page/tags/0.9.3/includes/wplp-api.php#L14"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ivan Cese"}], "timeline": [{"time": "2025-12-05T17:38:17.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-08T21:11:33.660023Z", "id": "CVE-2025-13629", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-08T21:11:43.968Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13629", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-08T21:11:33.660023Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-08T21:11:39.325Z"}}], "cna": {"title": "WP Landing Page <= 0.9.3 - Cross-Site Request Forgery to Arbitrary Post Meta Update", "credits": [{"lang": "en", "type": "finder", "value": "Ivan Cese"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "xbenx", "product": "WP Landing Page", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.9.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-05T17:38:17.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/43d8576b-e6ad-4e0a-b99f-948ba36f53ff?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-landing-page/trunk/includes/wplp-api.php#L14"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-landing-page/tags/0.9.3/includes/wplp-api.php#L14"}], "descriptions": [{"lang": "en", "value": "The WP Landing Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the 'wplp_api_update_text' function. This makes it possible for unauthenticated attackers to update arbitrary post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:14.832Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13629", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:49:14.832Z", "dateReserved": "2025-11-24T21:40:10.616Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-06T05:49:26.481Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Landing Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the 'wplp_api_update_text' function. This makes it possible for unauthenticated attackers to update arbitrary post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "id": "CVE-2025-13629", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-12-06T06:15:51.927", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-landing-page/tags/0.9.3/includes/wplp-api.php#L14"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-landing-page/trunk/includes/wplp-api.php#L14"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/43d8576b-e6ad-4e0a-b99f-948ba36f53ff?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:19:47.145194+00:00", "value": {"mitigation_remediation": ["Upgrade WP Landing Page to a version newer than 0.9.3 that implements nonce validation for the wplp_api_update_text endpoint.", "If no patch is available, deactivate the plugin or restrict its use to trusted administrators only.", "Configure web application firewall rules to block unauthenticated POST requests to the wplp_api_update_text action, ensuring only requests bearing a valid CSRF token are processed."], "summary": {"action": "Patch Plugin", "impact": "Cross\u2011Site Request Forgery"}, "threat_synthesis": {"affected_systems": "Any WordPress site running the WP Landing Page plugin version 0.9.3 or older is affected. The vulnerability is limited to the plugin and does not impact core WordPress or other plugins. Sites that rely on the plugin to manage landing pages or meta data for posts are therefore at risk.", "description_and_impact": "The WP Landing Page plugin for WordPress contains a CSRF flaw that allows an attacker to update arbitrary post meta by sending a forged request when an administrator clicks a link. The flaw arises because the wplp_api_update_text endpoint does not validate a nonce, so any unauthenticated request can be accepted. An attacker can then modify any post meta key/value pair, potentially changing content, settings, or other data that the site administrator expects to be protected.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity. EPSS below 1% shows low likelihood of observed exploitation at this time. The vulnerability is not listed in CISA KEV. Attackers would need to lure an administrator into clicking a malicious link or submitting a form that triggers the unchecked endpoint. Once the endpoint is hit, the attacker can alter any post meta without authentication, making exploitation straightforward given a successful social engineering vector."}}}}, "created": "2025-12-08T09:39:29.707916+00:00", "updated": "2026-04-22T00:30:04.043249+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}