CVE-2025-30632: Global Translator CSRF Vulnerability

CVE-2025-30632 Overview

CVE-2025-30632 is a Cross-Site Request Forgery (CSRF) vulnerability in the pozzad Global Translator plugin for WordPress. The flaw affects all versions up to and including 2.0.2. An attacker can craft a malicious web page that, when visited by an authenticated administrator, triggers unauthorized state-changing actions in the plugin. The weakness is categorized under CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker can trick an authenticated user into performing unintended plugin actions by loading attacker-controlled content, potentially modifying translator settings on the target WordPress site.

Affected Products

pozzad Global Translator WordPress plugin <= 2.0.2
WordPress sites with the global-translator plugin installed and activated
Administrators or privileged users who authenticate to the WordPress admin console

Discovery Timeline

2025-06-06 - CVE-2025-30632 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30632

Vulnerability Analysis

The Global Translator plugin exposes administrative actions that lack proper anti-CSRF protection. WordPress provides a nonce mechanism through wp_nonce_field() and check_admin_referer() to bind requests to a user session. The plugin does not enforce this nonce verification on affected endpoints. An attacker exploits the browser's ambient authentication to submit forged requests on behalf of the victim.

Successful exploitation requires user interaction. The victim must be authenticated to the WordPress site and load attacker-supplied content, such as a link or an embedded image in an email or third-party site. Impact is limited to integrity and availability of plugin settings, with no direct confidentiality loss.

The EPSS probability is 0.144%, reflecting a low observed exploitation likelihood in the wild, and no public proof-of-concept or in-the-wild exploitation has been recorded.

Root Cause

The root cause is missing or improperly validated CSRF tokens on state-changing HTTP requests handled by the plugin. Without a per-request nonce tied to the user's session, the server accepts any request that carries valid session cookies, regardless of origin.

Attack Vector

The attack is delivered over the network and requires user interaction. An attacker hosts a page containing a hidden form or auto-submitting JavaScript that targets a vulnerable plugin endpoint on the victim's WordPress site. When an authenticated administrator visits the attacker's page, the browser submits the forged request with valid session cookies. The plugin processes the request as legitimate.

No verified proof-of-concept code is publicly available. Refer to the Patchstack WordPress Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-30632

Indicators of Compromise

Unexpected changes to Global Translator plugin configuration or language settings on a WordPress site.
Administrator POST requests to plugin endpoints with Referer headers pointing to external, untrusted domains.
WordPress audit log entries showing configuration updates that administrators did not initiate.

Detection Strategies

Inspect web server access logs for POST requests to global-translator plugin endpoints that lack an expected _wpnonce parameter.
Correlate administrator sessions with request origins by comparing Referer and Origin headers against the WordPress site domain.
Deploy a Web Application Firewall (WAF) rule to flag cross-origin state-changing requests to /wp-admin/ paths associated with the plugin.

Monitoring Recommendations

Enable WordPress audit logging with a plugin such as WP Activity Log to capture setting changes.
Alert on administrative actions performed shortly after users visit external links, indicating possible CSRF chains.
Monitor plugin file integrity and settings tables (wp_options) for unauthorized modifications.

How to Mitigate CVE-2025-30632

Immediate Actions Required

Update the Global Translator plugin to a version later than 2.0.2 once the vendor publishes a fix.
Deactivate and remove the global-translator plugin if no patched release is available for your site.
Force session invalidation for administrator accounts and rotate credentials to reduce residual risk.

Patch Information

As of the last NVD update, no fixed version above 2.0.2 is confirmed. Administrators should monitor the Patchstack advisory and the plugin's WordPress.org page for a security release addressing CWE-352.

Workarounds

Restrict administrative access to the WordPress dashboard by source IP using web server or WAF rules.
Require administrators to use a dedicated browser or profile for WordPress management to limit exposure to attacker-controlled pages.
Enforce SameSite=Strict or SameSite=Lax on WordPress authentication cookies to reduce cross-site request submission.

bash

# Example: enforce SameSite on WordPress auth cookies via wp-config.php
# Add near the top of wp-config.php
define('COOKIE_SAMESITE', 'Strict');

# Example nginx rule to block cross-origin POSTs to the plugin path
location ~* /wp-admin/admin\.php {
    if ($http_origin !~* ^https?://(www\.)?example\.com$) {
        return 403;
    }
}