---
title: CSRF
canonical: https://wpsecurityninja.com/dictionary/csrf/
---
# CSRF

CSRF tricks a logged-in browser into sending a request the user did not mean to send.

## Why it matters for WordPress

If an Administrator is logged in and visits a malicious page, that page can try to submit forms to `wp-admin` as the admin. WordPress core uses nonces to stop most of this. Custom plugins that skip nonce and capability checks stay risky.

## How it shows up in practice

- A settings change or plugin install the admin does not remember
- CVE write-ups that mention missing nonce checks on an AJAX or admin-post handler
- Combined attacks: XSS plus CSRF to escalate impact from a lower foothold

## What to do

1. Keep WordPress and plugins updated (nonce bugs get patched).
2. For custom admin actions, verify nonces and real capabilities.
3. Log out of admin when browsing untrusted sites, or use a separate browser profile.
4. Prefer POST for state-changing actions; obscure URLs are not protection.