CVE-2025-30598 Overview
CVE-2025-30598 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Link OSS Upload (oss-upload) WordPress plugin. The flaw impacts all plugin versions up to and including 4.8.9. An attacker can trick an authenticated user into submitting forged requests that perform state-changing operations against the plugin without the user's consent. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery and requires user interaction to trigger, such as clicking a crafted link or visiting an attacker-controlled page while authenticated to the target WordPress site.
Critical Impact
Attackers can abuse authenticated administrator sessions to perform unauthorized actions in the OSS Upload plugin, resulting in limited integrity impact on affected WordPress installations.
Affected Products
- Link OSS Upload WordPress plugin versions through 4.8.9
- WordPress sites with the oss-upload plugin installed and activated
- Administrator and privileged user sessions on affected sites
Discovery Timeline
- 2025-03-24 - CVE-2025-30598 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30598
Vulnerability Analysis
The OSS Upload plugin fails to validate the origin of state-changing HTTP requests. WordPress provides a nonce mechanism through wp_nonce_field() and check_admin_referer() to protect administrative actions, but the affected plugin endpoints do not enforce these checks. An attacker who lures a logged-in administrator to a malicious page can force the browser to submit a request that the plugin processes as if it were legitimate. The Exploit Prediction Scoring System places this issue at a low probability of exploitation in the wild, but any WordPress site running the vulnerable plugin remains exposed until patched.
Root Cause
The root cause is missing CSRF token validation on sensitive plugin actions. Without a nonce or equivalent anti-forgery token, the plugin cannot distinguish between a request initiated by the user through the admin interface and one triggered externally by an attacker-controlled site. The browser automatically attaches session cookies to cross-origin requests directed at the WordPress instance, allowing the forged action to execute in the authenticated user's context.
Attack Vector
Exploitation proceeds over the network and requires user interaction. An attacker hosts a page containing a hidden form or JavaScript that auto-submits a request to a vulnerable oss-upload endpoint. When an authenticated WordPress administrator visits the page, the browser issues the request with valid session cookies. The plugin processes the request without verifying its origin, allowing the attacker-supplied parameters to modify plugin state or trigger unintended uploads. Refer to the Patchstack Security Advisory for technical details.
Detection Methods for CVE-2025-30598
Indicators of Compromise
- Unexpected POST requests to oss-upload plugin endpoints originating from external Referer headers
- Administrative actions performed outside normal session windows or from unusual client IP addresses
- New or modified plugin configuration entries with no corresponding audit log entry from the administrator
Detection Strategies
- Inspect WordPress access logs for POST requests to plugin URIs where the Referer header does not match the site domain
- Correlate authenticated administrator sessions with browser activity to identify requests triggered by third-party pages
- Deploy a web application firewall rule that flags requests to oss-upload handlers lacking a valid nonce parameter
Monitoring Recommendations
- Enable WordPress audit logging plugins to record all plugin configuration changes and file uploads
- Alert on cross-origin form submissions targeting /wp-admin/ endpoints associated with the oss-upload plugin
- Review outbound object storage transfers for anomalous uploads that do not align with expected content workflows
How to Mitigate CVE-2025-30598
Immediate Actions Required
- Update the OSS Upload plugin to a version later than 4.8.9 as soon as the vendor publishes a fix
- Deactivate the oss-upload plugin on affected WordPress installations until a patched release is available
- Require administrators to log out of WordPress sessions before browsing untrusted sites
Patch Information
At the time of publication, the affected versions include all releases of OSS Upload through 4.8.9. Consult the Patchstack Security Advisory for the current patched version and vendor guidance. Apply the update through the WordPress plugin manager or by replacing the plugin directory with the fixed release.
Workarounds
- Restrict access to /wp-admin/ using IP allowlists at the web server or WAF layer to limit the population of users who can be targeted
- Deploy a WAF rule that enforces Referer and Origin header validation for requests to the oss-upload plugin
- Enforce short session lifetimes and require re-authentication for privileged actions to reduce the exposure window
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
