Cross-Site Request Forgery (CSRF) in WordPress: The Silent Account Hijacker

Table of Contents 4 sections

What is CSRF?

Cross-Site Request Forgery (CSRF) is an attack that forces an authenticated user to perform unwanted actions on a web application. Unlike XSS, which exploits user trust in a site, CSRF exploits a site's trust in the user's browser.

If a WordPress administrator visits a malicious page while logged in, a CSRF attack could silently create a new admin account, change site settings, install a plugin, or delete content — all without the admin's knowledge.

How CSRF Attacks Work

The Attack Flow

1. The victim logs into their WordPress site (creating an authenticated session)
2. The victim visits a malicious page (via email link, forum post, or compromised site)
3. The malicious page contains a hidden form or JavaScript that sends a request to the WordPress site
4. The browser automatically includes the victim's session cookies with the request
5. WordPress processes the request as if the admin made it intentionally

Example: Creating an Admin Account via CSRF

<!-- Malicious page hosted on attacker's server -->
<form action="https://target-site.com/wp-admin/user-new.php" method="POST" id="csrf-form">
  <input type="hidden" name="user_login" value="hacker" />
  <input type="hidden" name="email" value="hacker@evil.com" />
  <input type="hidden" name="pass1" value="SuperSecureP@ss" />
  <input type="hidden" name="role" value="administrator" />
  <input type="hidden" name="createuser" value="1" />
</form>
<script>document.getElementById('csrf-form').submit();</script>

If the WordPress site doesn't properly verify nonces, this request will succeed because the browser sends the admin's session cookie.

Common CSRF Targets in WordPress

• Plugin settings pages — Changing plugin configurations without nonce checks
• User management — Creating, deleting, or modifying user roles
• Content management — Publishing, deleting, or modifying posts and pages
• Theme/plugin installation — Installing backdoored themes or plugins
• AJAX handlers — Admin-ajax.php endpoints without nonce verification

Preventing CSRF in WordPress

For Site Owners

1. Keep WordPress and plugins updated — CSRF fixes are common in security patches
2. Use a security plugin — Many add additional CSRF protections and SameSite cookie configuration
3. Log out when done — Don't leave admin sessions active while browsing other sites
4. Use separate browsers — Consider using one browser for admin tasks and another for general browsing

For Developers

1. Always use nonces — Generate with wp_nonce_field() and verify with wp_verify_nonce() or check_admin_referer()
2. Verify nonces on all state-changing requests — Every form submission and AJAX call that modifies data must include nonce verification
3. Use check_ajax_referer() — For AJAX endpoints, this function verifies both the nonce and the referrer
4. Set SameSite cookie attribute — Configure cookies with SameSite=Strict or SameSite=Lax to prevent cross-origin cookie sending