CVE-2025-30549 Overview
CVE-2025-30549 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Yummly Rich Recipes WordPress plugin. The flaw impacts all plugin versions up to and including 4.2. An attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user, triggers unintended state-changing actions on the target site.
Exploitation requires user interaction, and the resulting impact is limited to integrity of plugin-managed data. No authentication is required from the attacker, but a victim with an active session must interact with attacker-controlled content.
Critical Impact
Attackers can trick authenticated WordPress users into executing unauthorized actions in the Yummly Rich Recipes plugin, resulting in low-integrity impact on affected sites.
Affected Products
- Yummly Rich Recipes WordPress plugin, all versions from n/a through 4.2
- WordPress installations with the yummly-rich-recipes plugin active
- Sites running an unpatched release beyond version 4.2 where no fixed version has been published
Discovery Timeline
- 2025-03-24 - CVE-2025-30549 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30549
Vulnerability Analysis
The Yummly Rich Recipes plugin fails to validate the origin or authenticity of state-changing HTTP requests. WordPress provides a nonce mechanism (wp_nonce_field, check_admin_referer, wp_verify_nonce) to protect administrative actions against forged requests. The affected plugin either omits nonce checks or fails to validate them correctly on one or more request handlers.
Because the plugin's action handlers accept requests solely on the basis of the victim's authenticated session cookie, any HTTP request originating from an attacker-controlled context inherits the victim's privileges. This class of flaw maps to [CWE-352] Cross-Site Request Forgery.
Root Cause
The root cause is missing or improperly implemented CSRF protection on plugin request handlers. Server-side code does not verify a per-session nonce or a same-origin token before performing sensitive operations tied to the authenticated user's session.
Attack Vector
An attacker hosts a malicious page containing an auto-submitting form or img/fetch request targeted at the vulnerable plugin endpoint. When a logged-in WordPress user visits the page, the browser attaches the WordPress session cookie automatically and issues the forged request. The plugin processes the request as though it were a legitimate action initiated by the user.
Exploitation requires user interaction (UI:R) and network reachability of the target WordPress site. Successful exploitation results in low integrity impact on plugin-controlled data. Refer to the Patchstack WordPress Vulnerability Report for advisory details.
Detection Methods for CVE-2025-30549
Indicators of Compromise
- Unexpected modifications to Yummly Rich Recipes plugin content, settings, or recipe entries without a matching administrator audit trail.
- Web server access logs showing plugin action requests with Referer headers pointing to external, untrusted domains.
- Authenticated POST requests to wp-admin/admin.php or admin-ajax.php targeting yummly-rich-recipes actions that lack a valid _wpnonce parameter.
Detection Strategies
- Inspect HTTP request logs for state-changing requests to plugin endpoints where the Referer or Origin header does not match the WordPress site's own domain.
- Correlate plugin configuration changes with the initiating administrator session and IP address to identify actions inconsistent with normal user behavior.
- Deploy a Web Application Firewall (WAF) rule that alerts on cross-origin POST requests to wp-admin paths lacking a nonce token.
Monitoring Recommendations
- Enable WordPress audit logging plugins to record administrator actions and configuration changes for later review.
- Monitor outbound email or notifications generated by the plugin that could indicate forged actions executed on behalf of a logged-in user.
- Alert on anomalous administrator activity occurring outside normal business hours or from unfamiliar geolocations.
How to Mitigate CVE-2025-30549
Immediate Actions Required
- Identify all WordPress sites running the Yummly Rich Recipes plugin at version 4.2 or earlier and inventory the exposed endpoints.
- Deactivate the plugin if a fixed release is not yet available and the functionality is not business-critical.
- Enforce browser session hygiene for WordPress administrators, including logging out of the admin console when not in use.
Patch Information
At the time of this writing, the Patchstack advisory lists affected versions through 4.2 without a confirmed fixed version. Administrators should monitor the plugin's changelog on the WordPress Plugin Directory and apply the vendor-provided update as soon as it is released.
Workarounds
- Restrict access to the WordPress administration interface using IP allow-listing at the web server or WAF layer.
- Deploy a WAF rule that blocks POST requests to plugin endpoints when the Origin or Referer header does not match the site's canonical domain.
- Require administrators to use a dedicated browser profile for WordPress administration to reduce the likelihood of session reuse across untrusted sites.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
