CVE-2025-27342: WooCommerce Recargo CSRF Vulnerability

CVE-2025-27342 Overview

CVE-2025-27342 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WooCommerce Recargo de Equivalencia WordPress plugin developed by josesan. The flaw exists in all versions up to and including 1.6.24. An attacker can craft a malicious web page that, when visited by an authenticated site administrator, triggers unauthorized state-changing requests within the plugin. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
A remote attacker can trick an authenticated WordPress user into performing unintended actions on the woo-recargo-de-equivalencia plugin, potentially altering tax or equivalence surcharge configurations on WooCommerce stores.

Affected Products

WooCommerce Recargo de Equivalencia plugin (woo-recargo-de-equivalencia) versions through 1.6.24
WordPress installations running the affected plugin
WooCommerce storefronts using this plugin for Spanish tax equivalence surcharge calculations

Discovery Timeline

2025-02-24 - CVE-2025-27342 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27342

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery (CSRF) weakness in the woo-recargo-de-equivalencia WordPress plugin. The plugin fails to validate the origin of state-changing HTTP requests, meaning it does not enforce anti-CSRF tokens such as WordPress nonces on sensitive administrative actions. An attacker exploits this by hosting a malicious page or embedding a crafted request. When a logged-in administrator visits the attacker-controlled resource, the browser automatically submits the forged request using the victim's active session cookies.

Exploitation requires user interaction, as reflected in the attack vector metadata. Successful exploitation results in a limited integrity impact, allowing the attacker to modify plugin settings without the administrator's consent. Confidentiality and availability are not directly affected by the flaw.

Root Cause

The root cause is the absence or improper implementation of anti-CSRF protections on privileged plugin endpoints. WordPress provides wp_nonce_field() and check_admin_referer() primitives for CSRF mitigation, but the affected plugin versions do not validate these tokens on the relevant request handlers. This design gap allows any cross-origin request carrying the victim's authentication cookie to be processed as legitimate.

Attack Vector

The attack is delivered over the network and requires user interaction. An attacker crafts an HTML page containing a hidden form or image tag that issues a request to the vulnerable plugin endpoint on the target WordPress site. The attacker then lures an authenticated administrator to open the page through phishing, forum links, or malicious advertising. The victim's browser transmits session cookies with the forged request, and the plugin executes the action under the administrator's identity. See the Patchstack advisory for technical details.

Detection Methods for CVE-2025-27342

Indicators of Compromise

Unexpected changes to woo-recargo-de-equivalencia plugin settings or WooCommerce tax configuration entries in wp_options
HTTP POST or GET requests to plugin administrative endpoints with Referer headers pointing to external, untrusted domains
Administrative actions logged from user sessions immediately after those users browsed external links or email content

Detection Strategies

Inspect web server access logs for requests to plugin admin URLs that lack an expected Referer header or contain an off-domain referrer
Enable WordPress audit logging plugins to capture setting changes tied to woo-recargo-de-equivalencia and correlate them with user activity
Compare current plugin configuration against a known-good baseline to identify unauthorized modifications

Monitoring Recommendations

Alert on administrative POST requests to /wp-admin/admin.php or /wp-admin/options.php that originate from external referrers
Monitor for anomalous session activity where administrators execute configuration changes shortly after clicking external links
Track plugin version inventory across managed WordPress sites to identify installations still running 1.6.24 or earlier

How to Mitigate CVE-2025-27342

Immediate Actions Required

Update the woo-recargo-de-equivalencia plugin to a version later than 1.6.24 once the vendor releases a fix
Restrict administrator accounts and require re-authentication for sensitive WooCommerce configuration changes
Train administrators to log out of WordPress sessions before browsing untrusted content

Patch Information

At the time of publication, the Patchstack advisory documents that all versions through 1.6.24 are affected. Site operators should monitor the plugin's WordPress.org page and the vendor channel for a patched release, and apply the update as soon as it becomes available.

Workarounds

Deactivate the woo-recargo-de-equivalencia plugin until a fixed version is published if the equivalence surcharge feature is not business-critical
Deploy a Web Application Firewall (WAF) rule that inspects the Referer and Origin headers on requests to WordPress admin endpoints and blocks cross-origin submissions
Enforce SameSite=Strict or SameSite=Lax on WordPress authentication cookies to reduce cross-origin cookie transmission

bash

# Example WAF rule (ModSecurity) to block cross-origin POSTs to WP admin
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1002734,phase:2,deny,status:403,\
  msg:'Cross-origin POST to WP admin blocked'"
  SecRule REQUEST_URI "@beginsWith /wp-admin/" \
    "chain"
    SecRule REQUEST_HEADERS:Origin "!@beginsWith https://your-site.example" \
      "t:none"