CVE-2025-27290 Overview
CVE-2025-27290 is a Cross-Site Request Forgery (CSRF) vulnerability in the Erima Zarinpal Donate WordPress plugin developed by seyyed-amir. The flaw affects all versions of the erima-zarinpal-donate plugin up through version 1.0. An attacker can trick an authenticated user into submitting a forged request that performs unintended actions on the vulnerable site. The vulnerability is tracked under CWE-352 (Cross-Site Request Forgery) and carries a CVSS 3.1 score of 4.3. Exploitation requires user interaction, such as clicking a malicious link or visiting an attacker-controlled page while logged in.
Critical Impact
Successful exploitation allows an attacker to perform state-changing actions on behalf of an authenticated WordPress user, potentially altering plugin settings or donation configurations without consent.
Affected Products
- Erima Zarinpal Donate WordPress plugin (erima-zarinpal-donate)
- All versions from n/a through 1.0
- WordPress sites that have installed and activated the plugin
Discovery Timeline
- 2025-02-24 - CVE-2025-27290 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-27290
Vulnerability Analysis
The Erima Zarinpal Donate plugin fails to implement adequate anti-CSRF protections on one or more state-changing request handlers. WordPress plugins typically defend against CSRF using nonces generated with wp_create_nonce() and verified with check_admin_referer() or wp_verify_nonce(). When these controls are absent or improperly validated, any authenticated session can be abused by a remote attacker who lures the victim to a crafted page.
Because the attack vector is network-based and requires no privileges, any visitor to an attacker-controlled site can trigger the forged request. The impact is limited to integrity — confidentiality and availability are not directly affected according to the CVSS vector. The vulnerability is classified under CWE-352.
Root Cause
The root cause is the absence or improper verification of CSRF tokens on privileged endpoints exposed by the plugin. Requests submitted to these endpoints are trusted solely based on the user's authenticated session cookie. Browsers automatically attach session cookies to cross-origin requests, allowing a forged request from a third-party site to succeed.
Attack Vector
An attacker hosts a malicious HTML page containing an auto-submitting form or JavaScript request targeting the vulnerable plugin endpoint. When an authenticated WordPress administrator or privileged user visits the page, the browser submits the request with the victim's cookies. The plugin processes the request as legitimate and performs the requested action, such as changing donation settings.
No verified proof-of-concept code has been published for this issue. See the Patchstack advisory for the technical reference.
Detection Methods for CVE-2025-27290
Indicators of Compromise
- Unexpected changes to Erima Zarinpal Donate plugin configuration or donation destination accounts
- Web server access logs showing POST requests to plugin endpoints with Referer headers pointing to external domains
- Administrator sessions coinciding with outbound navigation to untrusted sites immediately before configuration changes
- Absence of WordPress nonce parameters (_wpnonce, _ajax_nonce) in successful plugin state-change requests
Detection Strategies
- Review WordPress audit logs for plugin settings modifications lacking a valid administrative workflow context
- Inspect HTTP request logs for cross-origin Referer values on requests targeting /wp-admin/admin-post.php or /wp-admin/admin-ajax.php with the plugin's action parameter
- Deploy a Web Application Firewall (WAF) rule that flags state-changing requests to the plugin path missing valid nonce tokens
Monitoring Recommendations
- Enable a WordPress activity log plugin to track configuration and option changes with user attribution
- Monitor for the plugin's presence and version across managed WordPress sites and flag installations at version 1.0 or earlier
- Alert on administrative account activity outside normal working hours or from anomalous source IP addresses
How to Mitigate CVE-2025-27290
Immediate Actions Required
- Deactivate and remove the Erima Zarinpal Donate plugin until a patched release is available from the developer
- Audit donation configuration and payment routing settings for unauthorized modifications
- Force logout of all active WordPress administrator sessions and rotate administrator credentials if tampering is suspected
- Restrict access to /wp-admin/ by IP allowlist where operationally feasible
Patch Information
No vendor patch has been published at the time of this writing. The advisory tracked by Patchstack covers all versions through 1.0. Site owners should monitor the plugin's repository page for a fixed release and apply it as soon as it becomes available.
Workarounds
- Remove or disable the erima-zarinpal-donate plugin on all affected WordPress installations
- Deploy a WAF rule that enforces the presence of a WordPress nonce parameter on requests to plugin endpoints
- Require administrators to use a separate browser profile or dedicated browser for WordPress administration to limit CSRF exposure
- Implement SameSite=Lax or SameSite=Strict cookie attributes on the WordPress session cookie at the reverse proxy layer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
