CVE-2025-30555: wp2wb WordPress Plugin CSRF Vulnerability

CVE-2025-30555 Overview

CVE-2025-30555 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin "同步微博" (wp2wb) developed by iiiryan. This vulnerability allows attackers to chain CSRF with Stored Cross-Site Scripting (XSS), enabling malicious actors to inject persistent scripts into the vulnerable WordPress site through crafted requests that exploit missing CSRF protections.

Critical Impact

Attackers can leverage CSRF to inject malicious JavaScript that persists in the WordPress database, potentially affecting all visitors to the compromised site and enabling session hijacking, credential theft, or further site compromise.

Affected Products

• WordPress wp2wb (同步微博) plugin versions through 1.1.0
• WordPress installations running the affected wp2wb plugin

Discovery Timeline

• 2025-03-24 - CVE-2025-30555 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-30555

Vulnerability Analysis

This vulnerability combines two distinct attack techniques: Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS). The wp2wb plugin, designed to synchronize WordPress content with Weibo (a Chinese social media platform), fails to implement proper CSRF token validation on certain administrative actions.

When an authenticated administrator visits a malicious page crafted by an attacker, the browser automatically includes authentication cookies with the forged request. Without CSRF token validation, the plugin processes the malicious request as if it were legitimate. The attacker exploits this to inject malicious JavaScript code that gets stored in the WordPress database.

Once the malicious script is stored, it executes whenever any user (including administrators) views the affected page. This stored XSS payload can perform actions such as stealing session tokens, modifying page content, redirecting users to phishing sites, or creating new administrator accounts.

Root Cause

The root cause of CVE-2025-30555 is the absence of nonce verification (WordPress's CSRF protection mechanism) on form submissions or AJAX handlers within the wp2wb plugin. WordPress provides the wp_nonce_field() and check_admin_referer() functions specifically to prevent CSRF attacks, but the plugin fails to implement these security controls on sensitive operations.

Additionally, the plugin lacks proper input sanitization and output encoding when handling user-supplied data, which enables the Stored XSS component of this vulnerability chain.

Attack Vector

The attack requires social engineering to trick an authenticated WordPress administrator into visiting a malicious webpage. The attacker crafts an HTML page containing a hidden form or JavaScript that automatically submits a request to the vulnerable plugin endpoint. This request includes malicious XSS payload data that bypasses input validation.

The attack flow typically involves:

1. Attacker identifies a vulnerable wp2wb installation
2. Attacker creates a malicious webpage with auto-submitting form targeting the plugin's unprotected endpoint
3. Attacker tricks an authenticated administrator into visiting the malicious page
4. The administrator's browser submits the forged request with the XSS payload
5. The plugin stores the malicious script in the database without proper sanitization
6. The stored XSS executes when pages containing the injected content are viewed

For technical details regarding the specific vulnerable endpoints and exploitation methodology, refer to the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2025-30555

Indicators of Compromise

• Unexpected JavaScript code or <script> tags in plugin settings or database entries associated with wp2wb
• Suspicious administrative actions in WordPress audit logs without corresponding legitimate user activity
• New administrator accounts created without authorization
• Unusual outbound network connections from the WordPress server to unknown domains
• Reports of redirect behavior or pop-ups from site visitors

Detection Strategies

• Monitor WordPress database tables for unexpected script injections or suspicious content patterns
• Implement Web Application Firewall (WAF) rules to detect and block CSRF attack patterns targeting wp2wb endpoints
• Review access logs for requests to wp2wb admin endpoints from external referrers
• Deploy Content Security Policy (CSP) headers to mitigate XSS execution and provide violation reports

Monitoring Recommendations

• Enable WordPress audit logging to track all administrative changes and plugin configuration modifications
• Configure alerts for new user account creation, especially administrator-level accounts
• Monitor for changes to wp2wb plugin settings that were not initiated through normal administrative workflows
• Implement real-time file integrity monitoring on WordPress core files and plugin directories

How to Mitigate CVE-2025-30555

Immediate Actions Required

• Deactivate and remove the wp2wb plugin from all WordPress installations until a patched version is available
• Audit the WordPress database for any injected scripts or suspicious content related to the plugin
• Review WordPress user accounts and remove any unauthorized administrator accounts
• Force password resets for all administrative users as a precautionary measure
• Implement a Web Application Firewall with CSRF and XSS protection rules

Patch Information

As of the last available information, WordPress wp2wb versions through 1.1.0 remain affected. Site administrators should check the Patchstack WordPress Vulnerability Report for updates on vendor patches and remediation guidance.

If a patched version is not available, consider permanently removing the plugin and seeking an alternative solution for WordPress-to-Weibo synchronization that follows WordPress security best practices.

Workarounds

• Remove or deactivate the wp2wb plugin entirely until a security patch is released
• Restrict access to WordPress admin panels using IP allowlisting or VPN requirements
• Implement additional authentication layers such as two-factor authentication for all administrator accounts
• Deploy browser-level protections like NoScript for administrators to reduce XSS impact
• Use WordPress security plugins that provide CSRF protection and input sanitization at the application level

# Configuration example - Disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp2wb --path=/var/www/html/wordpress

# Remove the plugin completely
wp plugin uninstall wp2wb --path=/var/www/html/wordpress

# Audit for suspicious user accounts
wp user list --role=administrator --path=/var/www/html/wordpress