CVE-2025-30805 Overview
CVE-2025-30805 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the wpdesk Flexible Cookies plugin for WordPress. The flaw impacts all plugin versions up to and including 1.1.8. The weakness is classified under CWE-352: Cross-Site Request Forgery.
An attacker can trick an authenticated WordPress user into submitting a forged request that performs unintended actions within the plugin. Exploitation requires user interaction, such as visiting an attacker-controlled page while authenticated to the target site.
Critical Impact
Successful exploitation allows attackers to modify plugin state through the authenticated victim's browser, resulting in low-level integrity impact on affected WordPress installations.
Affected Products
- wpdesk Flexible Cookies plugin for WordPress
- Versions from n/a through 1.1.8 (inclusive)
- WordPress sites with the vulnerable plugin installed and active
Discovery Timeline
- 2025-03-27 - CVE-2025-30805 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30805
Vulnerability Analysis
The Flexible Cookies plugin fails to properly validate the origin and authenticity of state-changing HTTP requests. WordPress plugins are expected to protect sensitive actions using nonces via wp_nonce_field() and check_admin_referer() or wp_verify_nonce(). When these checks are missing or improperly implemented, an attacker can craft a malicious page that submits requests on behalf of an authenticated user.
The vulnerability produces low integrity impact with no direct impact on confidentiality or availability. Exploitation requires the victim to be authenticated to the target WordPress site and to interact with attacker-controlled content, such as clicking a link or loading a page containing an auto-submitting form.
Root Cause
The root cause is missing or insufficient anti-CSRF token validation on plugin endpoints that perform state-changing operations. Without a validated nonce tied to the user session, the plugin cannot distinguish between legitimate requests originating from its own admin interface and forged requests initiated by third-party sites.
Attack Vector
Exploitation proceeds over the network without requiring authentication on the attacker's side. The attacker hosts a page containing a crafted HTML form or JavaScript that automatically issues a request to the vulnerable plugin endpoint. When an authenticated administrator or privileged user visits the page, their browser submits the request with valid session cookies, causing the plugin to process the unauthorized action.
Refer to the Patchstack Vulnerability Report for additional technical detail.
Detection Methods for CVE-2025-30805
Indicators of Compromise
- Unexpected changes to Flexible Cookies plugin configuration or settings.
- WordPress access logs showing state-changing POST requests to plugin endpoints with Referer headers pointing to unrelated external domains.
- Administrative actions performed outside of normal working hours or from unusual source addresses.
Detection Strategies
- Inspect WordPress audit logs for plugin configuration changes that do not correlate with legitimate administrator activity.
- Monitor HTTP request patterns to wp-admin endpoints associated with the Flexible Cookies plugin, especially requests lacking valid nonce parameters.
- Deploy a web application firewall (WAF) rule to flag POST requests to plugin endpoints with missing or mismatched Origin and Referer headers.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record all administrative and plugin-level changes.
- Alert on privileged user sessions initiating state-changing requests immediately after visiting external URLs.
- Review the plugin version installed across all managed WordPress sites and inventory hosts running versions <= 1.1.8.
How to Mitigate CVE-2025-30805
Immediate Actions Required
- Update the Flexible Cookies plugin to a version later than 1.1.8 once a patched release is available from wpdesk.
- Audit administrator accounts and review recent plugin configuration changes for signs of unauthorized modification.
- Advise administrators to log out of WordPress sessions before browsing untrusted external content.
Patch Information
At the time of publication, the vulnerability affects all versions up to and including 1.1.8. Consult the Patchstack Vulnerability Report and the wpdesk plugin repository for the latest fixed release information.
Workarounds
- Deactivate and remove the Flexible Cookies plugin until a patched version is deployed.
- Restrict administrator access to the WordPress dashboard using IP allowlisting at the web server or WAF layer.
- Enforce strict SameSite=Strict or SameSite=Lax cookie attributes on WordPress authentication cookies to reduce cross-site request risk.
- Require administrators to use a dedicated browser or browser profile for WordPress administration to limit exposure to malicious third-party content.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
