CVE-2025-30767 Overview
CVE-2025-30767 is a Missing Authorization vulnerability [CWE-862] in the PDF for WPForms plugin by add-ons.org for WordPress. The flaw affects all versions up to and including 5.3.0 and allows authenticated users with low privileges to exploit incorrectly configured access control levels. The vulnerability enables arbitrary shortcode execution, according to the Patchstack advisory. An attacker with basic authenticated access can trigger shortcodes that would normally require higher privilege levels, potentially exposing sensitive form data or triggering unintended plugin functionality.
Critical Impact
Authenticated attackers with low privileges can execute arbitrary WordPress shortcodes, leading to information disclosure and integrity impact across affected WPForms installations.
Affected Products
- add-ons.org PDF for WPForms plugin (pdf-for-wpforms)
- All versions from n/a through 5.3.0
- WordPress sites with the plugin installed and activated
Discovery Timeline
- 2025-03-27 - CVE-2025-30767 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30767
Vulnerability Analysis
The vulnerability resides in the PDF for WPForms plugin, which extends WPForms with PDF generation capability. The plugin exposes functionality that permits arbitrary shortcode execution without proper authorization checks. WordPress shortcodes can render dynamic content, query database entries, and invoke plugin actions. When a shortcode handler is reachable by an authenticated low-privilege user without capability validation, it becomes a pivot for accessing data or triggering operations reserved for administrators.
The Patchstack report classifies this as an arbitrary shortcode execution vulnerability. The EPSS probability sits at 0.367%, indicating limited observed exploitation attempts at this time.
Root Cause
The root cause is a missing capability check [CWE-862] on a plugin endpoint that processes shortcode input. The plugin accepts shortcode content from a request context accessible to authenticated users, then passes the input through do_shortcode() or an equivalent processor without confirming the caller holds the required WordPress capability. This design flaw treats authentication as authorization.
Attack Vector
Exploitation requires network access and low-privilege authenticated credentials, such as a Subscriber or Contributor account. No user interaction is needed. The attacker sends a crafted request to the vulnerable endpoint containing arbitrary shortcode markup. The plugin evaluates the shortcode server-side and returns rendered output, enabling the attacker to invoke shortcodes registered by WPForms or other installed plugins. See the Patchstack Security Vulnerability Report for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-30767
Indicators of Compromise
- Unexpected POST or AJAX requests from low-privilege authenticated user sessions to admin-ajax.php referencing PDF for WPForms actions.
- Log entries showing shortcode strings such as [wpforms ...] or other privileged shortcodes originating from non-administrator accounts.
- Anomalous PDF generation activity or downloads tied to accounts that should not have form access.
Detection Strategies
- Review WordPress access logs for requests to plugin endpoints (/wp-admin/admin-ajax.php, /wp-json/) that include shortcode payloads from Subscriber or Contributor accounts.
- Enable a WordPress security audit plugin to record shortcode execution and capability checks per request.
- Correlate authentication events with plugin activity to identify low-privilege users invoking administrative shortcodes.
Monitoring Recommendations
- Alert on any low-privilege account issuing requests containing shortcode-like brackets in POST bodies to plugin endpoints.
- Monitor the file system for unexpected PDF artifacts generated outside normal form submission workflows.
- Track plugin version inventory across WordPress deployments to identify hosts still running pdf-for-wpforms version 5.3.0 or earlier.
How to Mitigate CVE-2025-30767
Immediate Actions Required
- Update the PDF for WPForms plugin to a version later than 5.3.0 as soon as the vendor publishes a fixed release.
- Audit WordPress user accounts and remove or downgrade any unnecessary low-privilege accounts that could be leveraged for exploitation.
- Rotate credentials for any account suspected of unauthorized use since the plugin was installed.
Patch Information
At the time of this article, the Patchstack advisory identifies all versions up to and including 5.3.0 as vulnerable. Site administrators should consult the Patchstack Security Vulnerability Report and the plugin repository for the current patched release. Apply updates in a staging environment before deploying to production.
Workarounds
- Deactivate and remove the PDF for WPForms plugin until a patched version is installed.
- Restrict access to /wp-admin/admin-ajax.php for unauthenticated and low-privilege users through a web application firewall rule that blocks shortcode markup in request bodies.
- Enforce the principle of least privilege by disabling open user registration and limiting account creation to trusted roles.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
