CVE-2025-30612: Replace Default Words CSRF Vulnerability

CVE-2025-30612 Overview

CVE-2025-30612 is a Cross-Site Request Forgery (CSRF) vulnerability in the mandegarweb Replace Default Words plugin for WordPress. The flaw affects all plugin versions up to and including 1.3. An attacker can leverage the CSRF weakness to inject Stored Cross-Site Scripting (XSS) payloads into the WordPress site. The issue is tracked under CWE-352 and requires user interaction from an authenticated administrator to succeed.

Critical Impact
Successful exploitation enables stored XSS that executes in administrator browser sessions, allowing session theft, content manipulation, and persistent malicious payload delivery to site visitors.

Affected Products

mandegarweb Replace Default Words plugin for WordPress
All versions from initial release through 1.3
WordPress installations with the replace-default-words plugin enabled

Discovery Timeline

2025-03-24 - CVE-2025-30612 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30612

Vulnerability Analysis

The vulnerability combines two web application weaknesses into a single attack chain. The plugin processes state-changing administrative requests without verifying a valid anti-CSRF token (WordPress nonce). This omission allows an attacker to craft a malicious page that submits forged requests on behalf of an authenticated administrator. Because the same request handler also fails to sanitize input before persisting it, the forged request stores attacker-controlled JavaScript in the database. The injected payload then executes whenever a user loads a page that renders the stored value.

The Exploit Prediction Scoring System (EPSS) currently rates the probability of exploitation at 0.064%, reflecting limited observed exploitation activity. The combined CSRF-to-stored-XSS pattern remains a common attack chain against under-maintained WordPress plugins.

Root Cause

The root cause is missing CSRF protection on the plugin's settings or word-replacement submission endpoint. WordPress provides wp_nonce_field() and check_admin_referer() for this purpose, but the plugin does not invoke these verification routines. A secondary defect is the absence of output encoding when the stored values are later rendered in the administrative interface or front end.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a malicious page containing an auto-submitting form or XMLHttpRequest targeting the vulnerable plugin endpoint. The attacker lures an authenticated WordPress administrator to visit the page through phishing or a watering-hole link. The victim's browser submits the forged request with valid session cookies, causing the plugin to persist the attacker's XSS payload. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-30612

Indicators of Compromise

Unexpected <script> tags, event handlers, or obfuscated JavaScript in Replace Default Words plugin configuration entries
WordPress administrator sessions making POST requests to plugin endpoints with HTTP Referer headers pointing to external domains
New or modified administrator accounts created shortly after an admin user browsed an untrusted site
Outbound requests from administrator browsers to unfamiliar domains after visiting wp-admin pages

Detection Strategies

Audit the WordPress database tables wp_options and any plugin-specific tables for HTML or JavaScript characters in stored word-replacement values
Review web server access logs for POST requests to replace-default-words plugin handlers that lack a same-origin Referer header
Deploy a Web Application Firewall (WAF) rule that inspects plugin POST bodies for <script, onerror=, javascript:, and similar XSS markers

Monitoring Recommendations

Enable WordPress audit logging to record plugin setting changes with timestamps and source IP addresses
Monitor administrator endpoints for anomalous browser activity using EDR telemetry that captures process and network behavior
Alert on creation of new administrator users or modification of privileged roles outside scheduled change windows

How to Mitigate CVE-2025-30612

Immediate Actions Required

Deactivate and remove the Replace Default Words plugin from any WordPress installation running version 1.3 or earlier until a patched release is available
Inspect all plugin-stored content for injected scripts and remove any malicious entries
Force a password reset and session invalidation for all WordPress administrator accounts

Patch Information

At the time of publication, no vendor-supplied patched version is referenced in the available advisories. The Patchstack Vulnerability Report lists affected versions as n/a through <= 1.3. Site owners should monitor the plugin's WordPress.org listing for an update and replace the plugin with a maintained alternative if no fix is issued.

Workarounds

Remove the replace-default-words plugin directory from wp-content/plugins/ to fully disable the vulnerable code path
Restrict access to /wp-admin/ by IP allowlist at the web server or reverse proxy layer to reduce CSRF exposure
Deploy a Content Security Policy (CSP) header that disallows inline scripts to limit the impact of stored XSS execution
Require administrators to use a dedicated browser profile for WordPress management to prevent cross-session CSRF

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate replace-default-words
wp plugin delete replace-default-words

# Apply a restrictive Content Security Policy in nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";