CVE-2025-30804: wpShopGermany IT-RECHT KANZLEI CSRF Flaw

CVE-2025-30804 Overview

CVE-2025-30804 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the wpShopGermany IT-RECHT KANZLEI WordPress plugin developed by maennchen1.de. The flaw exists in all plugin versions up to and including 2.0. An attacker can trick an authenticated WordPress user into submitting a forged request that performs unintended state-changing actions within the plugin. The vulnerability is classified under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction, such as clicking a crafted link or visiting an attacker-controlled page while authenticated to the target WordPress site.

Critical Impact
An attacker can leverage the trust of an authenticated administrator's browser session to trigger unauthorized modifications within the wpShopGermany IT-RECHT KANZLEI plugin, potentially altering plugin data or configuration without the victim's consent.

Affected Products

wpShopGermany IT-RECHT KANZLEI WordPress plugin (all versions from n/a through <= 2.0)
WordPress installations with the vulnerable wpshopgermany-it-recht-kanzlei plugin active
Vendor: maennchen1.de

Discovery Timeline

2025-03-27 - CVE-2025-30804 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30804

Vulnerability Analysis

The vulnerability stems from missing or improperly implemented CSRF protections in the wpShopGermany IT-RECHT KANZLEI plugin. WordPress plugins are expected to validate state-changing requests using nonces generated with wp_create_nonce() and verified with check_admin_referer() or wp_verify_nonce(). When these controls are absent, any authenticated action handler will accept requests originating from third-party domains as long as the victim's browser carries a valid session cookie. The attack requires the victim to interact with a malicious page while logged into the affected WordPress site. Because the vulnerability targets integrity of plugin state without exposing confidential data, the impact is limited to unauthorized modifications rather than data disclosure or availability loss.

Root Cause

The root cause is the absence of anti-CSRF tokens on one or more request handlers in the wpshopgermany-it-recht-kanzlei plugin through version 2.0. The plugin trusts the presence of an authenticated session cookie as sufficient authorization, without validating request origin or a per-session nonce. This design fails to distinguish between requests intentionally initiated by the user and those forged by a remote attacker.

Attack Vector

An attacker crafts an HTML page containing an auto-submitting form or image tag targeting the vulnerable plugin endpoint. The attacker then lures a logged-in WordPress administrator to visit the page through phishing, a comment link, or a compromised third-party site. Once the victim loads the attacker's page, the victim's browser transmits the forged request along with the WordPress session cookie, causing the plugin to execute the action as the authenticated user. See the Patchstack Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-30804

Indicators of Compromise

Unexpected changes to wpshopgermany-it-recht-kanzlei plugin settings or content that cannot be attributed to legitimate administrator activity.
WordPress access logs showing POST requests to plugin endpoints with Referer headers pointing to external, untrusted domains.
Administrator sessions immediately preceded by visits to unfamiliar URLs delivered via email, chat, or comments.

Detection Strategies

Inspect web server logs for state-changing HTTP requests to plugin endpoints that lack expected _wpnonce parameters.
Correlate WordPress audit trail entries with browsing telemetry to identify configuration changes that follow external referrer activity.
Deploy a web application firewall rule to flag requests to the plugin's admin-facing paths that originate from cross-origin referrers.

Monitoring Recommendations

Enable a WordPress audit logging plugin to track option changes, user role modifications, and plugin configuration updates.
Monitor for anomalous administrator behavior, including configuration changes outside normal working hours.
Alert on repeated failed nonce validations, which can indicate CSRF probing against other plugins on the same site.

How to Mitigate CVE-2025-30804

Immediate Actions Required

Deactivate the wpShopGermany IT-RECHT KANZLEI plugin until a patched version above 2.0 is released and installed.
Restrict WordPress administrator accounts to dedicated browser profiles that are not used for general web browsing.
Review recent plugin configuration and content changes and revert unauthorized modifications.
Enforce multi-factor authentication on all WordPress administrator accounts to raise the cost of session abuse.

Patch Information

At the time of the last NVD update, the advisory lists all versions through <= 2.0 as affected, with no fixed version identified. Monitor the Patchstack Vulnerability Advisory and the plugin's official distribution channel for a security update, and apply it immediately when available.

Workarounds

Deploy a web application firewall rule that blocks requests to the plugin's endpoints when the Referer or Origin header does not match the site's own domain.
Require administrators to log out of the WordPress dashboard when not actively performing administrative tasks to reduce the window for CSRF abuse.
Use browser extensions or SameSite=Strict cookie policies to limit cross-site cookie transmission on administrator workstations.

bash

# Example: Enforce SameSite=Strict on WordPress auth cookies via wp-config.php
# Add the following before the "That's all, stop editing!" line
define('COOKIE_DOMAIN', 'example.com');
@ini_set('session.cookie_samesite', 'Strict');
@ini_set('session.cookie_secure', '1');
@ini_set('session.cookie_httponly', '1');