Security Alert Summary
The LEAV Last Email Address Validator plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in versions ≤ 1.7.1. The issue is caused by missing or incorrect nonce validation in the display_settings_page function, which can allow an attacker to modify plugin settings if they can trick an authenticated administrator into performing an action (for example, clicking a link).
CVE Details
- CVE ID: CVE-2025-14853
- Affected component: LEAV Last Email Address Validator plugin for WordPress
- Affected versions: versions ≤ 1.7.1
- Published: January 16, 2026 at 07:15:56 AM UTC
- Last modified: January 16, 2026 at 03:55:12 PM UTC
- CVSS v3.1: Base Score 4.3 — MEDIUM
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
- Vector:
- CWE / Weakness: CWE-352 (Cross-Site Request Forgery)
Technical Details
This vulnerability is a Cross-Site Request Forgery (CSRF) issue resulting from missing or incorrect nonce validation in the plugin’s settings page handling. The CVE description identifies the affected code path as the display_settings_page function. Because the function does not correctly validate a WordPress nonce for requests that change plugin settings, a crafted request originating from an attacker-controlled page can perform actions on behalf of an authenticated administrator who interacts with the malicious content (for example, by clicking a link).
The impact is limited to modification of the plugin’s settings (integrity impact classified as low). The entry does not specify particular settings values that would be changed, nor does it provide details of any additional endpoints or functions beyond display_settings_page.
How This Could Impact Your Website
Consider a typical small site setup: a site owner (administrator) manages the site, an internal staff member (editor) maintains content, and an external contractor helps with forms or email lists. An attacker could craft a URL or web page and trick the administrator into visiting it. If the administrator follows the attacker’s link while authenticated in the WordPress admin, the attacker could cause changes to the LEAV plugin settings without needing to authenticate themselves.
Practical consequences are limited to changes in the plugin’s configuration (integrity impact). Those changes might alter how email validation behaves within your site or disable particular checks the site relies on for form data validation, potentially leading to unwanted data being accepted or different validation behavior. The CVE indicates confidentiality and availability impacts are none.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Review and reduce unnecessary user roles and administrative access, especially for contributors and editors who do not require settings-level privileges.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and administrative actions for unusual behavior or unexpected changes to plugin settings.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/last-email-address-validator/trunk/includes/leav-settings-page.inc.php#L2183
- https://plugins.trac.wordpress.org/browser/last-email-address-validator/trunk/includes/leav-settings-page.inc.php#L257
- https://plugins.trac.wordpress.org/browser/last-email-address-validator/trunk/includes/leav-settings-page.inc.php#L66
- https://www.wordfence.com/threat-intel/vulnerabilities/id/93db56df-d21b-4788-84b2-7b28641b5a7a?source=cve
