CVE-2025-5983
📋 TL;DR
The Meta Tag Manager WordPress plugin before version 3.3 allows users with any role to create http-equiv refresh meta tags, which can be used to redirect visitors to malicious sites. This affects all WordPress sites using vulnerable versions of the plugin.
💻 Affected Systems
- Meta Tag Manager WordPress plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
An attacker with any user account could redirect all site visitors to phishing/malware sites, potentially compromising credentials or infecting visitors.
Likely Case
Low-privileged users could redirect visitors to unwanted sites, causing reputation damage and potential SEO penalties.
If Mitigated
With proper role-based access controls, only trusted administrators could create meta tags, preventing abuse.
🎯 Exploit Status
Exploitation requires at least a subscriber-level WordPress account. The vulnerability is simple to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3
Vendor Advisory: https://wpscan.com/vulnerability/4a2d4dcf-bb34-4eec-b5de-31c6a4d823cf/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Meta Tag Manager' and click 'Update Now'. 4. Verify version is 3.3 or higher.
🔧 Temporary Workarounds
Restrict user registration
allDisable new user registration to prevent attackers from creating accounts to exploit this vulnerability.
Remove vulnerable plugin
allTemporarily deactivate and delete the Meta Tag Manager plugin until patched.
🧯 If You Can't Patch
- Implement strict user role management and audit all existing user accounts
- Monitor website redirects and meta tag changes through security plugins
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Meta Tag Manager version.Check Version:
wp plugin list --name='meta-tag-manager' --field=versionVerify Fix Applied:
Confirm Meta Tag Manager version is 3.3 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual meta tag creation/modification by non-admin users
- HTTP redirect logs showing unexpected site redirections
Network Indicators:
- Unexpected HTTP 301/302 redirects from your WordPress site
SIEM Query:
source="wordpress.log" AND ("meta tag" OR "refresh" OR "redirect") AND user_role!="administrator"