CVE-2025-30550: CallPhone'r CSRF Vulnerability

CVE-2025-30550 Overview

CVE-2025-30550 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WPShop.ru CallPhone'r WordPress plugin. This security flaw allows attackers to chain CSRF with Stored Cross-Site Scripting (XSS), potentially enabling malicious actors to execute arbitrary JavaScript code in the context of authenticated users' browser sessions.

Critical Impact

Attackers can leverage CSRF to inject persistent malicious scripts into the WordPress site, affecting all users who view the compromised content and potentially leading to session hijacking, credential theft, or further site compromise.

Affected Products

• WPShop.ru CallPhone'r plugin versions up to and including 1.1.1
• WordPress installations with the CallPhone'r plugin enabled
• All user sessions interacting with compromised plugin content

Discovery Timeline

• 2025-03-24 - CVE-2025-30550 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30550

Vulnerability Analysis

This vulnerability combines two distinct attack vectors: Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS). The CallPhone'r plugin fails to implement proper anti-CSRF tokens on sensitive form submissions, allowing attackers to craft malicious requests that execute in the context of an authenticated administrator's session. When combined with insufficient input sanitization, this creates a pathway for persistent script injection.

The attack exploits the trust relationship between the browser and the WordPress installation. Since the plugin does not validate the origin of state-changing requests, an attacker can trick an authenticated administrator into visiting a malicious page that automatically submits crafted form data to the vulnerable plugin endpoints.

Root Cause

The root cause of CVE-2025-30550 is the absence of CSRF protection mechanisms (such as nonce verification) in the CallPhone'r plugin's administrative functions, combined with inadequate output encoding when rendering user-supplied data. The plugin fails to implement WordPress's built-in security functions like wp_nonce_field() for form protection and esc_html() or esc_attr() for proper output escaping.

Attack Vector

The attack leverages network-based delivery and requires user interaction. An attacker must convince an authenticated WordPress administrator to visit a malicious webpage while logged into the target WordPress site. The malicious page contains a hidden form or JavaScript that automatically submits a crafted request to the CallPhone'r plugin's vulnerable endpoint, injecting malicious JavaScript that persists in the database.

The exploitation flow involves:

1. Attacker crafts a malicious HTML page containing a hidden form targeting the vulnerable plugin endpoint
2. The form includes XSS payload in one of the plugin's configurable fields
3. Administrator visits the malicious page while authenticated to WordPress
4. Browser automatically submits the form to the WordPress site with the admin's session cookies
5. Malicious script is stored in the database without proper sanitization
6. All subsequent visitors viewing the affected content execute the injected script

Detection Methods for CVE-2025-30550

Indicators of Compromise

• Unexpected JavaScript code or <script> tags in CallPhone'r plugin configuration or database entries
• Suspicious outbound connections to unknown domains from visitor browsers
• Administrator session cookies being sent to external servers
• Unusual plugin setting modifications without corresponding administrative activity logs
• Reports of unexpected redirects or popups from site visitors

Detection Strategies

• Monitor WordPress database tables associated with the CallPhone'r plugin for unauthorized modifications
• Implement Content Security Policy (CSP) headers to detect and block unauthorized script execution
• Review web server access logs for suspicious POST requests to CallPhone'r plugin endpoints
• Deploy Web Application Firewall (WAF) rules to detect CSRF and XSS attack patterns

Monitoring Recommendations

• Enable WordPress audit logging to track all plugin configuration changes
• Configure alerts for database modifications to plugin-related tables outside normal administrative hours
• Monitor for referrer anomalies in requests to plugin administrative endpoints
• Implement browser-based XSS detection mechanisms and report violations via CSP reporting endpoints

How to Mitigate CVE-2025-30550

Immediate Actions Required

• Deactivate and uninstall the CallPhone'r plugin until a patched version is available
• Audit the WordPress database for any injected malicious scripts in plugin-related data
• Review and rotate session tokens for all WordPress administrators
• Implement a Web Application Firewall (WAF) with CSRF and XSS protection rules
• Scan the WordPress installation for additional indicators of compromise

Patch Information

As of the latest information available, all versions of CallPhone'r through 1.1.1 are affected. Site administrators should check Patchstack's WordPress Vulnerability Database for updates on patch availability and remediation guidance from the plugin vendor.

Workarounds

• Remove the CallPhone'r plugin entirely and replace with an alternative that implements proper security controls
• Implement server-level request filtering to block suspicious POST requests to plugin endpoints
• Add custom CSRF validation at the web server or WAF level for plugin administrative functions
• Restrict plugin administrative access to specific IP addresses using .htaccess or server configuration
• Deploy CSP headers to mitigate the impact of any successfully injected XSS payloads

# WordPress .htaccess example to restrict plugin admin access
<Files "admin*.php">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
</Files>

# Content-Security-Policy header example (add to wp-config.php or server config)
# header("Content-Security-Policy: default-src 'self'; script-src 'self'; report-uri /csp-report");