CVE-2025-30568: Super Static Cache CSRF Vulnerability

CVE-2025-30568 Overview

CVE-2025-30568 is a Cross-Site Request Forgery (CSRF) vulnerability in the hitoy Super Static Cache plugin for WordPress. The flaw affects all versions of Super Static Cache up to and including 3.3.5. The vulnerability is tracked under [CWE-352] and allows an attacker to trick an authenticated administrator into performing unintended state-changing actions.

The issue is exploitable over the network without prior authentication but requires user interaction, such as clicking a malicious link. Successful exploitation can modify plugin settings on behalf of the victim.

Critical Impact
An attacker can alter Super Static Cache plugin configuration by luring an authenticated WordPress administrator to a malicious page, potentially disrupting caching behavior and site availability.

Affected Products

hitoy Super Static Cache WordPress plugin (super-static-cache)
All versions from initial release through 3.3.5
WordPress installations with the plugin installed and activated

Discovery Timeline

2025-03-24 - CVE-2025-30568 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30568

Vulnerability Analysis

The Super Static Cache plugin exposes administrative actions that do not validate the origin or authenticity of requests. The plugin fails to implement WordPress anti-CSRF nonces on sensitive endpoints, which is the recommended mitigation via the wp_nonce_field() and check_admin_referer() APIs.

When an authenticated administrator visits an attacker-controlled page, the browser automatically sends the administrator's session cookies to the vulnerable WordPress endpoint. The plugin processes the forged request as if the administrator intentionally submitted it.

Impact is limited to integrity of plugin configuration. Confidentiality and availability of the underlying host are not directly affected, though modified cache settings could cause site inconsistency.

Root Cause

The root cause is missing CSRF token validation on administrative request handlers within the plugin. WordPress provides nonce primitives specifically to prevent this class of attack, but the affected code paths in Super Static Cache do not consume them.

Attack Vector

Exploitation requires that a logged-in WordPress administrator interact with attacker-controlled content while their session is active. The attacker hosts an HTML page containing an auto-submitting form or image tag that targets the vulnerable plugin endpoint. Because the request originates from the administrator's authenticated browser, WordPress processes it with administrator privileges.

No authentication material is disclosed to the attacker. The attack relies solely on riding the victim's existing session.

For technical details, see the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2025-30568

Indicators of Compromise

Unexpected changes to Super Static Cache plugin configuration in the WordPress admin dashboard
HTTP POST requests to Super Static Cache admin endpoints with Referer headers pointing to external, non-WordPress domains
Access log entries showing admin actions on the plugin without corresponding administrator navigation to the settings page

Detection Strategies

Inspect web server access logs for requests to wp-admin endpoints associated with super-static-cache that lack a valid same-origin Referer header
Monitor WordPress audit logs for plugin setting modifications outside of expected administrator activity windows
Alert on administrator session activity coinciding with visits to untrusted external domains

Monitoring Recommendations

Deploy a WordPress security audit plugin that records plugin configuration changes with timestamp and originating IP
Enforce logging of the Referer and Origin headers on all wp-admin POST requests via the web server
Review administrator browser telemetry for cross-site requests that trigger Set-Cookie reuse to the WordPress host

How to Mitigate CVE-2025-30568

Immediate Actions Required

Deactivate the Super Static Cache plugin until a patched version is confirmed available from the vendor
Require administrators to log out of WordPress when not actively managing the site to reduce session exposure
Restrict access to /wp-admin/ by IP allowlist where operationally feasible
Review recent plugin configuration for unauthorized changes and restore known-good settings

Patch Information

At the time of publication, the vendor advisory tracked at Patchstack lists all versions through 3.3.5 as affected, and no fixed release is identified in the referenced data. Monitor the Patchstack WordPress Vulnerability Report for updates and apply any vendor-supplied patch immediately when released.

Workarounds

Uninstall Super Static Cache and replace it with a maintained caching plugin that implements nonce validation
Deploy a web application firewall rule that blocks POST requests to plugin admin endpoints when the Origin or Referer header does not match the WordPress site domain
Enforce the SameSite=Strict attribute on WordPress authentication cookies to prevent cross-site cookie transmission

bash

# Example WAF rule (ModSecurity) to require same-origin Referer on plugin admin actions
SecRule REQUEST_URI "@contains /wp-admin/" \
  "chain,deny,status:403,id:1003056801,msg:'CSRF: cross-origin admin request blocked'"
  SecRule REQUEST_METHOD "@streq POST" "chain"
  SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-wordpress-site.example/"