CVE-2025-2111

The Insert Headers And Footers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability.

• CWE-352

• https://plugins.trac.wordpress.org/browser/wp-headers-and-footers/trunk/lib/wpb-sdk/views/wpb-debug.php#L63
• https://plugins.trac.wordpress.org/browser/wp-headers-and-footers/trunk/lib/wpb-sdk/views/wpb-debug.php#L69
• https://plugins.trac.wordpress.org/changeset/3276361/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7b00d175-261d-46e3-bf3c-2d18f4e4972d?source=cve

Published

Apr 19, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-21102Dell VxRail, versions 7.0.000 through 7.0.532, contain(s) a …4.4
• CVE-2025-21103Dell NetWorker Management Console, version(s) 19.11 through …7.8
• CVE-2025-21104Dell NetWorker, versions prior to 19.11.0.4 and version 19.1…6.5
• CVE-2025-21105Dell RecoverPoint for Virtual Machines 6.0.X contains a comm…7.8
• CVE-2025-21106Dell Recover Point for Virtual Machines 6.0.X contains a Wea…5.5
• CVE-2025-21107Dell NetWorker, version(s) prior to 19.11.0.3, all versions …7.8
• CVE-2025-21110Dell Data Lakehouse, versions prior to 1.5.0.0, contains an …4.4
• CVE-2025-21111Dell VxRail, versions 8.0.000 through 8.0.311, contain(s) a …4.4
• CVE-2025-21117Dell Avamar, version 19.4 or later, contains an access token…5.5
• CVE-2025-2112A vulnerability was found in user-xiangpeng yaoqishan up to …9.8
• CVE-2025-21120Dell Avamar, versions prior to 19.10 SP1 with patch 338904, …6.5
• CVE-2025-21121InDesign Desktop versions ID20.0, ID19.5.1 and earlier are a…7.8