CVE-2025-30620: WP Odoo Form Integrator CSRF Vulnerability

CVE-2025-30620 Overview

CVE-2025-30620 is a Cross-Site Request Forgery (CSRF) vulnerability in the coderscom WP Odoo Form Integrator plugin for WordPress. The flaw enables an unauthenticated attacker to trick an authenticated administrator into submitting forged requests that result in Stored Cross-Site Scripting (XSS). The vulnerability affects all versions of wp-odoo-form-integrator from n/a through 1.1.0. Successful exploitation injects persistent JavaScript that executes in the browsers of users who visit affected pages. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact

Attackers can persist malicious JavaScript across the WordPress site, hijacking administrator sessions and pivoting to full site compromise.

Affected Products

• coderscom WP Odoo Form Integrator plugin for WordPress
• All versions through 1.1.0
• WordPress sites with the plugin active and an authenticated administrator

Discovery Timeline

• 2025-03-24 - CVE-2025-30620 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30620

Vulnerability Analysis

The WP Odoo Form Integrator plugin exposes administrative actions that modify plugin settings without validating a CSRF token. When an authenticated WordPress administrator visits an attacker-controlled page, the browser issues a forged state-changing request to the plugin endpoint. The plugin accepts the request and stores attacker-supplied input in the database. The stored input is later rendered without proper output encoding, producing a Stored XSS condition. The chain converts a one-time social engineering interaction into persistent code execution in the browser context of any user loading the affected page.

Root Cause

The root cause is the absence of CSRF protection on plugin configuration handlers. WordPress provides the wp_nonce_field() and check_admin_referer() primitives to bind requests to a user session, and the affected handlers do not invoke them. The secondary defect is missing sanitization on stored input and missing escaping on output, which allows raw <script> payloads to be rendered into the DOM.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a page containing a hidden form or fetch() call that targets a vulnerable plugin endpoint. The attacker lures an authenticated administrator to the page through phishing, a forum post, or a comment link. The browser submits the request with the administrator's session cookies, and the plugin processes the payload as if it originated from the administrator. The injected script then executes whenever the affected page is loaded by any visitor, including other administrators.

No verified proof-of-concept code is publicly available. See the Patchstack advisory for additional technical context.

Detection Methods for CVE-2025-30620

Indicators of Compromise

• Unexpected <script> tags, onerror, or onload handlers in plugin-managed settings or form configurations stored in the wp_options table.
• WordPress access logs showing POST requests to WP Odoo Form Integrator admin endpoints with Referer headers pointing to external or unknown domains.
• New or modified administrator accounts and unexpected outbound requests from browsers loading affected pages.

Detection Strategies

• Audit the database for HTML or JavaScript content in plugin configuration fields that should contain plain text.
• Review WordPress administrator activity logs for plugin setting changes that lack a corresponding admin-initiated session.
• Deploy a Web Application Firewall (WAF) rule that inspects POST bodies to plugin endpoints for script tags and event handler attributes.

Monitoring Recommendations

• Monitor browser Content Security Policy (CSP) violation reports for inline script execution on pages rendered by the plugin.
• Alert on edits to plugin options performed without a valid _wpnonce parameter in the request.
• Track administrator session anomalies such as setting changes immediately after the user visited an external link.

How to Mitigate CVE-2025-30620

Immediate Actions Required

• Deactivate the WP Odoo Form Integrator plugin until a patched release above 1.1.0 is verified and installed.
• Rotate WordPress administrator credentials and invalidate active sessions if the plugin was active and exposed.
• Inspect the database for injected payloads in plugin-managed options and remove malicious content.

Patch Information

At the time of the latest NVD update, the advisory lists affected versions through 1.1.0 with no fixed version published in the referenced data. Monitor the Patchstack advisory and the plugin's WordPress.org listing for an official patched release.

Workarounds

• Remove or disable wp-odoo-form-integrator from wp-content/plugins/ until a fix is available.
• Enforce a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins.
• Require administrators to use a separate browser profile or session-isolated environment when performing privileged WordPress operations.

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp-odoo-form-integrator
wp plugin delete wp-odoo-form-integrator

# Audit options table for injected script payloads
wp db query "SELECT option_name FROM wp_options WHERE option_value LIKE '%<script%' OR option_value LIKE '%onerror=%';"