CVE-2025-0796
📋 TL;DR
This CSRF vulnerability in the Mortgage Lead Capture System WordPress plugin allows unauthenticated attackers to reset the plugin's settings by tricking administrators into clicking malicious links. All WordPress sites using this plugin up to version 8.2.10 are affected. The attack requires social engineering to get an administrator to perform an action.
💻 Affected Systems
- Mortgage Lead Capture System WordPress Plugin
📦 What is this software?
Wprequal by Kevinbrent
⚠️ Risk & Real-World Impact
Worst Case
Administrator clicks malicious link, resetting all plugin settings to defaults, potentially disrupting lead capture functionality and requiring manual reconfiguration.
Likely Case
Temporary disruption of mortgage lead capture functionality until settings are restored, with potential data loss of custom configurations.
If Mitigated
No impact if administrators don't click malicious links or if proper CSRF protections are implemented.
🎯 Exploit Status
Exploitation requires social engineering to trick administrators. The technical exploit is simple once the administrator performs the action.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.2.11 or later
Vendor Advisory: https://wordpress.org/plugins/wprequal/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Mortgage Lead Capture System' and check for updates. 4. Update to version 8.2.11 or later. 5. Verify the update completed successfully.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDeactivate the plugin until patched to prevent exploitation
wp plugin deactivate wprequal
🧯 If You Can't Patch
- Implement Content Security Policy headers to restrict external requests
- Educate administrators about phishing risks and safe browsing practices
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Mortgage Lead Capture System version 8.2.10 or earlierCheck Version:
wp plugin get wprequal --field=versionVerify Fix Applied:
Verify plugin version is 8.2.11 or later in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=wprequal_reset_defaults without valid nonce
- Plugin settings reset events in WordPress logs
Network Indicators:
- HTTP requests to WordPress admin-ajax endpoint with CSRF payloads
- Referer header mismatches on admin actions
SIEM Query:
source="wordpress" AND (uri_path="/wp-admin/admin-ajax.php" AND parameters.action="wprequal_reset_defaults")