Security readout for executives and security teams
Plain-English summary
Homerunner for WordPress through version 1.0.30 can let an attacker change plugin settings by persuading an administrator to trigger a forged request. The attacker does not need an account, but administrator interaction is required. Expected impact is limited to settings integrity; the supplied evidence does not establish data theft, service disruption, or code execution.
Executive priority
Schedule remediation in the normal near-term patch cycle, escalating sites where Homerunner controls business-sensitive checkout settings. The moderate rating reflects required administrator interaction and limited documented impact. Immediate emergency response is not supported by the supplied evidence, but exposed outdated installations should not remain indefinitely because unauthenticated attackers can target authenticated administrators.
Technical view
The main_settings() function lacks correct WordPress nonce validation, creating a cross-site request forgery vulnerability classified as CWE-352. Exploitation is network-accessible, requires low complexity and administrator interaction, and can modify plugin settings. CVSS 3.1 is 4.3 with integrity impact only. The supplied record identifies versions through 1.0.30 as vulnerable.
Likely exposure
WordPress sites using the Homerunner plugin at version 1.0.30 or earlier are potentially exposed, especially when administrators browse untrusted links while authenticated. The bundle’s structured affected-version entry is inconsistent with its title and description, so asset owners should confirm installed package identity and version directly.
Exploitation context
The supplied sources do not report active exploitation, and the CVE is not identified as being in KEV. A successful attack requires an administrator to perform an attacker-influenced action, such as following a crafted link, while able to change plugin settings. No exploit payload or broader compromise chain is established by the evidence.
Researcher notes
The key defect is absent or incorrect nonce validation in main_settings(). The pre-fix and 1.0.31 source references may support code comparison, but the bundle does not explicitly state that 1.0.31 is the fixed release. The structured affected data lists version “0” with default unaffected, conflicting with the narrative range; validate authoritative vendor metadata before automated fleet decisions.
Mitigation direction
- Identify every WordPress site running Homerunner and record its installed version.
- Update beyond version 1.0.30 after confirming current vendor guidance and compatibility.
- If updating is unavailable, disable the plugin until vendor-supported remediation is confirmed.
- Warn administrators against opening untrusted links while authenticated to WordPress.
- Review plugin settings for unauthorized changes and restore approved values.
Validation and detection
- Confirm the installed plugin slug and version on each WordPress instance.
- Verify production no longer runs Homerunner version 1.0.30 or earlier.
- Compare current plugin settings with approved configuration or recent backups.
- Review relevant administrative logs for unexpected settings changes or suspicious requests.
- Confirm the remediated settings handler performs appropriate nonce validation and authorization checks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-5932 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N2.81.4WordfenceVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineWordfence
Disclosed
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/36eaff34-50cd-4399-8314-19ae4f50d017?source=cveCVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/homerunner-smartcheckout/tags/1.0.29/classes/class-settings.php#L319CVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/homerunner-smartcheckout/tags/1.0.31/classes/class-settings.php#L483CVE reference, Wordfence
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.