---
title: CSRF
canonical: https://wpsecurityninja.com/dictionary/csrf/
---
# CSRF

CSRF tricks a logged-in browser into sending a request the user did not mean to send.

Last updated: 2026-08-26

Also called: cross-site request forgery, cross site request forgery

## Related terms

- [Cross-site scripting (XSS)](https://wpsecurityninja.com/dictionary/xss/): Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- [Session hijacking](https://wpsecurityninja.com/dictionary/session-hijacking/): Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.
- [Two-factor authentication (2FA)](https://wpsecurityninja.com/dictionary/two-factor-authentication/): Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- [WordPress nonce](https://wpsecurityninja.com/dictionary/wordpress-nonce/): A WordPress nonce is a short-lived token used to verify that a request was intentional, mainly to reduce CSRF risk.

## Why it matters for WordPress

If an Administrator is logged in and visits a malicious page, that page can try to submit forms to `wp-admin` as the admin. WordPress core uses nonces to stop most of this. Custom plugins that skip nonce and capability checks stay risky.

## How it shows up in practice

- A settings change or plugin install the admin does not remember
- CVE write-ups that mention missing nonce checks on an AJAX or admin-post handler
- Combined attacks: XSS plus CSRF to escalate impact from a lower foothold

## What to do

1. Keep WordPress and plugins updated (nonce bugs get patched).
2. For custom admin actions, verify nonces and real capabilities.
3. Log out of admin when browsing untrusted sites, or use a separate browser profile.
4. Prefer POST for state-changing actions; obscure URLs are not protection.