Attacks Dictionary
CSRF
Definition
CSRF tricks a logged-in browser into sending a request the user did not mean to send.
Also called: cross-site request forgery, cross site request forgery
Why it matters for WordPress
If an admin is logged in and visits a malicious page, that page can try to submit forms to wp-admin as the admin. WordPress core uses nonces to stop most of this. Custom plugins that skip nonces stay risky.
How it shows up in practice
- Settings change or plugin install the admin does not remember
- CVE write-ups that mention missing nonce checks
- Combined attacks: XSS plus CSRF to escalate impact
What to do
- Keep WordPress and plugins updated (nonce bugs get patched).
- For custom admin actions, verify nonces and user capabilities.
- Log out of admin when browsing untrusted sites (or use a separate browser profile).
- Prefer POST for state-changing actions; never trust “security through obscure URLs” alone.
Related terms
Nearby ideas in the dictionary
- Cross-site scripting (XSS) Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- Session hijacking Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.