CVE-2025-30801: TWB Woocommerce Reviews CSRF Vulnerability

CVE-2025-30801 Overview

CVE-2025-30801 is a Cross-Site Request Forgery (CSRF) vulnerability in the Abu Bakar TWB Woocommerce Reviews plugin for WordPress. The flaw affects all versions up to and including 1.7.7. An attacker can craft a malicious web page that, when visited by an authenticated site user, triggers unintended state-changing requests against the plugin. Exploitation requires user interaction, and the impact is limited to integrity of plugin-managed data. The issue is tracked under CWE-352 and was published to NVD on March 27, 2025.

Critical Impact
Attackers can trick authenticated WordPress users into performing unauthorized actions in the TWB Woocommerce Reviews plugin through forged HTTP requests.

Affected Products

Abu Bakar TWB Woocommerce Reviews plugin for WordPress
All versions from initial release through 1.7.7
WordPress sites running WooCommerce with the TWB Woocommerce Reviews plugin installed

Discovery Timeline

2025-03-27 - CVE-2025-30801 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30801

Vulnerability Analysis

The TWB Woocommerce Reviews plugin fails to validate the authenticity of state-changing HTTP requests. The plugin does not enforce anti-CSRF tokens (WordPress nonces) on one or more request handlers. An attacker exploits this by hosting a crafted page containing a form or script that submits requests to the vulnerable WordPress endpoint. When a logged-in administrator or privileged user visits the attacker-controlled page, the browser automatically attaches session cookies and executes the forged request.

The CVSS vector indicates the attack is delivered over the network and requires user interaction. Confidentiality and availability are not impacted, but integrity is affected because the attacker can alter plugin state on behalf of the victim. The EPSS score is 0.186%.

Root Cause

The root cause is missing or improper CSRF protection on plugin request handlers. WordPress provides wp_nonce_field() and check_admin_referer() primitives for this purpose. The plugin either omits nonce generation on outbound forms or fails to verify the nonce on the receiving handler, permitting requests that originate from arbitrary third-party origins.

Attack Vector

Exploitation proceeds through the following sequence. First, the attacker identifies a state-changing plugin action, such as a settings update or review-management operation, that lacks nonce enforcement. The attacker then publishes or emails a link to a page containing a hidden HTML form or fetch() call targeting the vulnerable endpoint. When a WordPress user with an active session loads the page, the browser submits the request with the user's cookies. The plugin processes the request as if the victim initiated it. The Patchstack advisory documents the specific parameters and endpoints involved. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-30801

Indicators of Compromise

HTTP POST requests to WordPress admin endpoints associated with the TWB Woocommerce Reviews plugin where the HTTP Referer header points to an external domain
Unexpected changes to plugin configuration, review content, or review moderation state in the WordPress database
WordPress access logs showing plugin actions executed shortly after users visited external links

Detection Strategies

Inspect web server access logs for requests to wp-admin/admin.php or plugin-specific action endpoints that lack a same-origin Referer header
Audit the WordPress wp_options table and plugin-managed tables for unexpected modification timestamps
Deploy a WordPress security plugin or web application firewall rule that flags administrative POST requests without valid nonces

Monitoring Recommendations

Enable WordPress audit logging to capture user-initiated administrative actions with source IP and referer metadata
Alert on browser-generated administrative requests originating from unusual referer domains
Monitor the WordPress plugin registry for updates to twb-woocommerce-reviews and correlate with change control records

How to Mitigate CVE-2025-30801

Immediate Actions Required

Deactivate the TWB Woocommerce Reviews plugin until a patched version is confirmed available and installed
Force logout of all WordPress administrator sessions to invalidate cookies that could be abused in a CSRF chain
Review recent plugin configuration and review-moderation activity for unauthorized changes

Patch Information

At the time of NVD publication, the advisory lists affected versions up to and including 1.7.7 with no fixed version identified in the enriched data. Site operators should consult the Patchstack Vulnerability Report for the latest patch status and upgrade guidance.

Workarounds

Remove or disable the plugin if a patched release is not yet available
Deploy a web application firewall rule that enforces same-origin referer validation on WordPress admin POST requests
Restrict WordPress administrative access to a VPN or IP allowlist to reduce exposure to drive-by CSRF pages
Train administrators to log out of WordPress before browsing untrusted content in the same browser session

bash

# Configuration example - disable the vulnerable plugin via WP-CLI
wp plugin deactivate twb-woocommerce-reviews
wp plugin status twb-woocommerce-reviews