Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2025-5932: Homerunner Plugin for WordPress Allows Attackers to Change Settings
CVE-2025-5932 · published 1 year ago
Summary
The Homerunner plugin for WordPress has a security flaw that lets attackers trick site administrators into changing plugin settings without permission. This can happen if an attacker tricks an administrator into clicking a malicious link. To fix this, update the Homerunner plugin to version 1.0.30 or later.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| coolrunner | homerunner |
<= 1.0.29 <= 1.0.30 cpe:2.3:a:coolrunner:homerunner:*:*:*:*:*:wordpress:*:* |
Original advisory text
Homerunner <= 1.0.30 - Cross-Site Request Forgery to Settings Update
The Homerunner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.30. This is due to missing or incorrect nonce validation on the main_settings() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published26 Jun 2025
Updated26 Oct 2026
First seen7 Mar 2026
Track software like this
Free during beta