CVE-2024-25930: WooCommerce Order Status Manager CSRF Flaw

CVE-2024-25930 Overview

CVE-2024-25930 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Nuggethon Custom Order Statuses for WooCommerce WordPress plugin. The flaw impacts all plugin versions from n/a through 1.5.2. The vulnerability is classified under [CWE-352] and can be exploited remotely over the network when an authenticated administrator is tricked into interacting with attacker-controlled content. Successful exploitation results in high impact to confidentiality, integrity, and availability of the affected WooCommerce store.

Critical Impact
An attacker can trick a logged-in administrator into submitting forged requests that modify order status configuration, enabling unauthorized state changes within the WooCommerce environment.

Affected Products

Nuggethon Custom Order Statuses for WooCommerce versions up to and including 1.5.2
WordPress sites running WooCommerce with the affected plugin installed
Any deployment using the nuggethon:custom_order_status_manager_for_woocommerce component

Discovery Timeline

2024-02-29 - CVE-2024-25930 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2024-25930

Vulnerability Analysis

The Custom Order Statuses for WooCommerce plugin does not validate the origin of state-changing HTTP requests. Administrative actions exposed by the plugin lack CSRF nonce verification, which WordPress provides through the wp_nonce_field() and check_admin_referer() functions. An attacker who lures an authenticated administrator to a malicious page can cause the browser to issue forged POST requests against the WordPress site. The browser automatically attaches session cookies, so the request executes with administrator privileges. This produces high impact across confidentiality, integrity, and availability because attackers can alter order status definitions used in the WooCommerce checkout pipeline.

Root Cause

The root cause is missing anti-CSRF token validation on administrative endpoints in versions up to 1.5.2. The plugin processes form submissions and AJAX actions without confirming the request originated from a trusted page within the WordPress admin interface.

Attack Vector

Exploitation requires user interaction from a privileged WordPress user, typically an administrator. The attacker hosts a crafted HTML page containing an auto-submitting form or image tag targeting the vulnerable plugin endpoint. When the victim visits the page while logged into WordPress, the browser sends the request with valid authentication cookies. No credentials or prior access to the target site are required from the attacker.

No verified public proof-of-concept code is available. Refer to the Patchstack CSRF Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2024-25930

Indicators of Compromise

Unexpected creation, modification, or deletion of custom order statuses within WooCommerce
Administrator-initiated POST requests to plugin endpoints with Referer headers pointing to external domains
WordPress audit log entries showing order status changes outside normal business workflows

Detection Strategies

Inspect web server access logs for requests to /wp-admin/admin.php or /wp-admin/admin-post.php targeting plugin actions without a same-origin Referer
Deploy a Web Application Firewall (WAF) rule that flags state-changing requests to the plugin lacking a valid _wpnonce parameter
Correlate WordPress user session activity with order status configuration changes to identify anomalous administrator actions

Monitoring Recommendations

Enable a WordPress audit logging plugin to track plugin settings changes and administrator actions
Forward WordPress and web server logs to a centralized SIEM for cross-correlation with browser session telemetry
Alert on administrator account activity originating from unfamiliar IP addresses or user agents

How to Mitigate CVE-2024-25930

Immediate Actions Required

Update Custom Order Statuses for WooCommerce to a version newer than 1.5.2 once the vendor releases a patched release
If no patched version is available, deactivate and remove the plugin from production WordPress installations
Audit existing custom order statuses for unauthorized modifications and restore from known-good backups if necessary

Patch Information

The NVD entry indicates the vulnerability affects versions through 1.5.2. Site administrators should consult the Patchstack CSRF Vulnerability Advisory and the official plugin repository for patched release availability.

Workarounds

Restrict access to the WordPress admin interface using IP allowlisting at the web server or WAF layer
Require administrators to use isolated browser profiles when managing WordPress to limit cross-site cookie exposure
Enforce short session lifetimes and require re-authentication before sensitive plugin actions

bash

# Example: restrict /wp-admin to trusted IPs in nginx
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}