CVE-2025-28984: WooCommerce Subscription CSRF Vulnerability

CVE-2025-28984 Overview

CVE-2025-28984 is a Cross-Site Request Forgery (CSRF) vulnerability in the storepro Subscription Renewal Reminders for WooCommerce WordPress plugin. The flaw affects all plugin versions up to and including 1.4.1. An attacker can craft a malicious request that triggers a notice dismissal action when an authenticated administrator visits an attacker-controlled page. The vulnerability is classified under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction, and the impact is limited to integrity of dismissible admin notices within the plugin.

Critical Impact
Attackers can forge authenticated administrator requests to dismiss plugin notices, requiring only that a logged-in admin visits a malicious page.

Affected Products

storepro Subscription Renewal Reminders for WooCommerce plugin versions n/a through 1.4.1
WordPress sites running WooCommerce with the affected plugin installed
Administrative sessions on any WordPress deployment using the vulnerable plugin

Discovery Timeline

2025-06-06 - CVE-2025-28984 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-28984

Vulnerability Analysis

The plugin exposes a state-changing action, specifically a notice dismissal handler, without validating the origin of the request. Because the endpoint does not verify a WordPress nonce or check the HTTP Referer header, any request that carries a valid administrator session cookie is accepted as legitimate. An attacker who tricks an authenticated administrator into loading an attacker-controlled page can cause the browser to submit a forged request against the WordPress site. The impact is limited to integrity of the notice-dismissal state and does not directly disclose data or affect availability.

Root Cause

The root cause is missing CSRF protection on plugin actions handled through admin-ajax.php or admin-post.php. The plugin does not call check_admin_referer() or wp_verify_nonce() before executing the dismissal logic. WordPress provides these primitives specifically to defeat CSRF, but the affected code paths omit them.

Attack Vector

An attacker hosts a page containing an auto-submitting HTML form or an image tag that targets the vulnerable plugin endpoint on the victim's WordPress site. The attacker lures a logged-in administrator to the page through phishing, a comment link, or a compromised third-party site. The victim's browser attaches the WordPress session cookie, and the plugin executes the dismissal action on behalf of the administrator. No credentials are transmitted to the attacker, and the action is confined to the functionality exposed by the vulnerable handler. See the Patchstack Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-28984

Indicators of Compromise

Unexpected notice-dismissal events in the WordPress admin panel that do not correlate with administrator activity.
HTTP POST or GET requests to plugin admin endpoints with Referer headers pointing to external, untrusted domains.
Access log entries showing plugin actions triggered immediately after an administrator visited an external URL.

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php or admin-post.php targeting subscriptions-renewal-reminders action names with off-site Referer values.
Correlate WordPress admin session activity with browser history or email gateway data to identify administrators who loaded suspicious external content.
Enumerate installed WordPress plugins across the estate and flag any host running Subscription Renewal Reminders for WooCommerce at version 1.4.1 or earlier.

Monitoring Recommendations

Enable audit logging on WordPress administrator accounts using a plugin such as WP Activity Log or a SIEM-forwarded module.
Alert on plugin actions that arrive with missing or cross-origin Referer and Origin headers.
Track outbound clicks from administrator webmail to detect phishing attempts that could deliver the CSRF payload.

How to Mitigate CVE-2025-28984

Immediate Actions Required

Upgrade Subscription Renewal Reminders for WooCommerce to a version later than 1.4.1 once the vendor publishes a fix.
Restrict WordPress administrator sessions by enforcing short session lifetimes and requiring re-authentication for sensitive actions.
Train administrators to log out of WordPress when not actively managing the site and to avoid clicking untrusted links while authenticated.

Patch Information

At the time of publication, the Patchstack Vulnerability Advisory lists all versions through 1.4.1 as affected. Administrators should monitor the WordPress plugin repository page for a patched release and apply it as soon as available.

Workarounds

Deactivate and remove the plugin until a patched version is published if the functionality is not business-critical.
Deploy a Web Application Firewall (WAF) rule that blocks requests to the plugin's admin endpoints when the Referer header does not match the site's own origin.
Enforce SameSite=Lax or SameSite=Strict cookies on the WordPress session to reduce cross-site request execution.

bash

# Example nginx rule to block off-origin POSTs to WordPress admin endpoints
location ~ ^/wp-admin/admin-(ajax|post)\.php$ {
    if ($http_referer !~* "^https?://your-site\.example/") {
        return 403;
    }
}