CVE-2025-30764: Football Pool CSRF Vulnerability

CVE-2025-30764 Overview

CVE-2025-30764 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the AntoineH Football Pool plugin for WordPress. The flaw impacts all versions up to and including 2.12.2. An attacker can craft a malicious web page that, when visited by an authenticated administrator, triggers unauthorized state-changing requests against the plugin's settings. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction but no authentication or elevated privileges on the attacker's side. The current EPSS probability is 0.186%, indicating low observed exploitation activity.

Critical Impact
Successful exploitation allows attackers to modify Football Pool plugin settings by tricking an authenticated administrator into visiting a crafted page, resulting in unauthorized configuration changes.

Affected Products

AntoineH Football Pool WordPress plugin versions up to and including 2.12.2
WordPress installations with the Football Pool plugin enabled
Sites where administrators maintain active authenticated sessions

Discovery Timeline

2025-03-27 - CVE-2025-30764 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30764

Vulnerability Analysis

The Football Pool plugin fails to enforce anti-CSRF protections on state-changing administrative actions. WordPress provides wp_nonce_field() and check_admin_referer() primitives to validate that a request originates from a legitimate user session. When these controls are missing or improperly validated, any authenticated administrator visiting an attacker-controlled page can be forced to submit requests that mutate plugin configuration.

The impact is limited to integrity of the plugin's settings. Confidentiality and availability remain unaffected based on the CVSS impact metrics. However, settings tampering can degrade the intended behavior of the Football Pool feature and, depending on which options are exposed, potentially enable follow-on attacks against site users.

Root Cause

The root cause is missing or improper CSRF token validation on one or more administrative endpoints within the Football Pool plugin. Requests that change plugin settings are accepted based solely on the presence of an authenticated session cookie, without verifying request origin through a nonce or referer check.

Attack Vector

Exploitation follows the standard CSRF pattern. An attacker hosts a page containing an auto-submitting HTML form or JavaScript-driven request targeting the vulnerable Football Pool settings endpoint. The attacker lures an authenticated WordPress administrator to the page through phishing, forum posts, or malicious advertising. The victim's browser attaches the WordPress session cookie automatically, and the server processes the settings change as if the administrator issued it directly.

The vulnerability mechanism is described in the Patchstack WordPress Vulnerability Report. No public proof-of-concept code is available at this time.

Detection Methods for CVE-2025-30764

Indicators of Compromise

Unexpected changes to Football Pool plugin configuration recorded in WordPress activity logs
POST requests to Football Pool administrative endpoints with Referer headers pointing to external, untrusted domains
Administrator-initiated settings changes correlated with visits to unfamiliar external URLs in browser history

Detection Strategies

Deploy a WordPress activity logging plugin to record plugin option changes and correlate them with administrator sessions
Inspect web server access logs for POST requests to Football Pool admin endpoints originating from off-site referers
Enable Content Security Policy (CSP) reporting on the WordPress admin interface to surface cross-origin form submissions

Monitoring Recommendations

Alert on modifications to WordPress wp_options rows associated with the Football Pool plugin
Monitor administrator accounts for anomalous configuration activity outside normal maintenance windows
Review outbound HTTP request patterns from administrator workstations to detect visits to suspicious sites during active WordPress sessions

How to Mitigate CVE-2025-30764

Immediate Actions Required

Update the AntoineH Football Pool plugin to a version later than 2.12.2 once a patched release is available from the vendor
Restrict WordPress administrator accounts to dedicated browsers or sessions not used for general web browsing
Require administrators to log out of WordPress when not actively managing the site

Patch Information

The advisory tracked in the Patchstack WordPress Vulnerability Report identifies all versions through 2.12.2 as affected. Site operators should monitor the plugin's WordPress.org listing and the Patchstack advisory for the fixed release version and apply it as soon as it is published.

Workarounds

Disable or remove the Football Pool plugin until a fixed version is released if the feature is not business-critical
Deploy a web application firewall rule that blocks POST requests to Football Pool admin endpoints when the Referer header is absent or points to an external origin
Enforce SameSite=Lax or SameSite=Strict on WordPress authentication cookies to reduce cross-origin request risk

bash

# Example: WAF rule concept to block cross-origin POSTs to the plugin admin endpoint
# Pseudocode - adapt to your WAF syntax (ModSecurity, Cloudflare, etc.)
if (request.method == "POST"
    && request.uri contains "/wp-admin/admin.php?page=football-pool"
    && (request.headers.referer is empty
        || request.headers.referer not_matches "^https://your-site\\.example/")) {
    action: block;
    log: "Blocked potential CSRF against Football Pool plugin (CVE-2025-30764)";
}