{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2111", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-07T23:55:37.419Z", "datePublished": "2025-04-19T05:30:13.219Z", "dateUpdated": "2026-04-08T17:02:26.129Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:26.129Z"}, "affected": [{"vendor": "hiddenpearls", "product": "Insert Headers And Footers", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Insert Headers And Footers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability."}], "title": "WP Headers And Footers <= 3.1.1 - Cross-Site Request Forgery to Arbitrary Options Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b00d175-261d-46e3-bf3c-2d18f4e4972d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-headers-and-footers/trunk/lib/wpb-sdk/views/wpb-debug.php#L69"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-headers-and-footers/trunk/lib/wpb-sdk/views/wpb-debug.php#L63"}, {"url": "https://plugins.trac.wordpress.org/changeset/3276361/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Carlos Ferreira"}], "timeline": [{"time": "2025-04-18T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-21T02:39:31.572128Z", "id": "CVE-2025-2111", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-21T02:39:44.237Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2111", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-21T02:39:31.572128Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-21T02:39:39.138Z"}}], "cna": {"title": "WP Headers And Footers <= 3.1.1 - Cross-Site Request Forgery to Arbitrary Options Update", "credits": [{"lang": "en", "type": "finder", "value": "Carlos Ferreira"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "hiddenpearls", "product": "Insert Headers And Footers", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-18T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b00d175-261d-46e3-bf3c-2d18f4e4972d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-headers-and-footers/trunk/lib/wpb-sdk/views/wpb-debug.php#L69"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-headers-and-footers/trunk/lib/wpb-sdk/views/wpb-debug.php#L63"}, {"url": "https://plugins.trac.wordpress.org/changeset/3276361/"}], "descriptions": [{"lang": "en", "value": "The Insert Headers And Footers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:26.129Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2111", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:26.129Z", "dateReserved": "2025-03-07T23:55:37.419Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-19T05:30:13.219Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Insert Headers And Footers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability."}, {"lang": "es", "value": "El complemento Insert Headers And Footers para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 3.1.1 incluida. Esto se debe a la falta o a una validaci\u00f3n incorrecta de nonce en la funci\u00f3n 'custom_plugin_set_option'. Esto permite a atacantes no autenticados actualizar opciones arbitrarias en el sitio de WordPress mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace. Esto puede aprovecharse para actualizar el rol predeterminado de registro a administrador y habilitar el registro de usuarios para que los atacantes obtengan acceso administrativo a un sitio vulnerable. La constante 'WPBRIGADE_SDK__DEV_MODE' debe establecerse en 'true' para explotar la vulnerabilidad."}], "id": "CVE-2025-2111", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-04-19T06:15:19.657", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-headers-and-footers/trunk/lib/wpb-sdk/views/wpb-debug.php#L63"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-headers-and-footers/trunk/lib/wpb-sdk/views/wpb-debug.php#L69"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3276361/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b00d175-261d-46e3-bf3c-2d18f4e4972d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T01:42:11.613965+00:00", "value": {"mitigation_remediation": ["Upgrade the Insert Headers And Footers plugin to the latest version that contains the fix.", "Disable or remove the WPBRIGADE_SDK__DEV_MODE constant from the site's configuration to prevent the exploit from functioning.", "Verify that no unauthorized administrator accounts exist and that the default registration role is set appropriately, reverting to a less privileged role if necessary."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "All releases of the Insert Headers And Footers plugin up to and including version 3.1.1 are affected. The plugin is distributed by hiddenpearls under the name Insert Headers And Footers for WordPress and should be upgraded to the latest version that fixes the CSRF flaw.", "description_and_impact": "The vulnerability arises from missing or incorrect nonce validation in the plugin's 'custom_plugin_set_option' function. This flaw allows an unauthenticated attacker, by tricking an administrator into visiting a crafted URL, to modify any plugin option on the site. By changing the default registration role to administrator and enabling user registration, an attacker can create an administrative account and gain full control of the WordPress installation.", "risk_and_exploitability": "The flaw carries a CVSS score of 7.5 and an EPSS score below 1 percent, indicating moderate severity with a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the site has the WPBRIGADE_SDK__DEV_MODE constant set to true and that an administrator clicks a malicious link that submits an unauthorized request to the 'custom_plugin_set_option' endpoint. Successful exploitation can lead to privilege escalation by creating an attacker-controlled administrator account."}}}}, "created": "2025-07-13T11:06:58.867767+00:00", "updated": "2026-04-22T01:45:05.625489+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}