Attacks Dictionary
CSRF
Definition
CSRF tricks a logged-in browser into sending a request the user did not mean to send.
Also called: cross-site request forgery, cross site request forgery
Why it matters for WordPress
If an Administrator is logged in and visits a malicious page, that page can try to submit forms to wp-admin as the admin. WordPress core uses nonces to stop most of this. Custom plugins that skip nonce and capability checks stay risky.
How it shows up in practice
- A settings change or plugin install the admin does not remember
- CVE write-ups that mention missing nonce checks on an AJAX or admin-post handler
- Combined attacks: XSS plus CSRF to escalate impact from a lower foothold
What to do
- Keep WordPress and plugins updated (nonce bugs get patched).
- For custom admin actions, verify nonces and real capabilities.
- Log out of admin when browsing untrusted sites, or use a separate browser profile.
- Prefer POST for state-changing actions; obscure URLs are not protection.
Related terms
Nearby ideas in the dictionary
- Cross-site scripting (XSS) Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- Session hijacking Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- WordPress nonce A WordPress nonce is a short-lived token used to verify that a request was intentional, mainly to reduce CSRF risk.
