Attack Vectors

Product: Page Title, Description & Open Graph Updater (slug: page-title-description-open-graph-updater) is affected by a Medium-severity Cross-Site Request Forgery (CSRF) issue (CVE-2025-13438, CVSS 4.3).

An attacker does not need to log in to your WordPress site to attempt exploitation. Instead, they rely on social engineering—for example, sending a link or webpage that an administrator is tricked into clicking while they are already logged into the WordPress admin area.

Because the vulnerable behavior is tied to missing verification on multiple AJAX actions (including dieno_update_page_title), a successful forged request can trigger changes without the admin realizing what was authorized.

Security Weakness

The vulnerability exists in all versions up to and including 1.02 of Page Title, Description & Open Graph Updater due to missing nonce validation on multiple AJAX actions. In practical terms, this means the site may not reliably confirm that a request to change titles or metadata was intentionally initiated by an authorized admin.

This is a classic CSRF scenario: the administrator’s existing authenticated session becomes the “vehicle” for unauthorized changes when they are induced to interact with attacker-controlled content.

Remediation status: there is no known patch available at this time. Organizations should evaluate mitigations based on risk tolerance, and it may be best to uninstall the affected plugin and replace it if the business impact is unacceptable.

Technical or Business Impacts

Brand and campaign risk: Unauthorized page title and metadata changes can alter how your pages appear in browsers, in shared links, and in search results previews—potentially confusing customers, undermining brand consistency, or reducing campaign performance.

SEO and analytics integrity: Even minor, unauthorized edits to titles/descriptions can distort SEO testing outcomes, degrade click-through rates, and create noise in performance reporting that marketing and leadership rely on for decisions.

Governance and compliance concerns: If your organization has approval workflows for public-facing content, untracked or unauthorized metadata changes can create audit gaps and complicate incident response, especially for regulated teams (e.g., Compliance, Finance, Healthcare).

Similar Attacks

CSRF has been a recurring class of web application risk and has been widely documented in real-world vulnerability catalogs and security guidance. For additional context, these references explain how CSRF is abused and why missing request validation is dangerous:

OWASP: Cross-Site Request Forgery (CSRF)
MITRE CWE-352: Cross-Site Request Forgery
CVE Record: CVE-2025-13438