I'm looking for to fix the issue below :

The following scenario show a successful CSRF attack resulting in the creation of a new user on wordpress:

  1. The attacker sends malicious html page to an application user using social engineering techniques.

  2. User executes the html page and the code embedded in the page instructs the user s browser to generate a new user creation request.


  1. The attacker successfully creates a new application user.

This is the begin for the source code of the form to create user :

enter image description here

  • 2
    this cannot append because the value of "nonce" is only provided at the connected user. then the attacker cannot guess it and he will not be able to create a user. – mmm Mar 20 '18 at 16:52
  • 2
    This won't work as you expect, but if it did, this would be considered irresponsible disclosure of a security hole. If you find a security hole in WP, report it via the official channels discretely so that it can be fixed before it's exploited – Tom J Nowell Mar 20 '18 at 17:05
  • It won't work since a valid nonce is required, but if you feel vulnerable you can block all external POST request in htaccess – nodws Mar 20 '18 at 17:19
  • Thanks. Is it possible to block external post request about create user form (user-new.php)? – sampaii Mar 20 '18 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.