CVE-2025-30816: Publish Post Email Notification CSRF Flaw

CVE-2025-30816 Overview

CVE-2025-30816 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Nks publish-post-email-notification WordPress plugin. The flaw allows attackers to trick authenticated administrators into submitting unintended requests that modify plugin settings. The issue impacts all plugin versions from unspecified initial release through 1.0.2.3. The vulnerability is classified under CWE-352: Cross-Site Request Forgery and requires user interaction to succeed.

Critical Impact

An attacker can force an authenticated WordPress administrator to unknowingly alter plugin settings by visiting a crafted page, resulting in unauthorized configuration changes to email notification behavior.

Affected Products

• Nks Publish Post Email Notification plugin for WordPress
• All versions up to and including 1.0.2.3
• WordPress sites with the plugin installed and active

Discovery Timeline

• 2025-03-27 - CVE-2025-30816 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30816

Vulnerability Analysis

The publish-post-email-notification plugin fails to validate the origin or authenticity of state-changing HTTP requests submitted to its settings handlers. WordPress provides a nonce mechanism through the wp_nonce_field() and check_admin_referer() functions, but the affected plugin versions do not enforce these checks on settings-modification endpoints. As a result, any request carrying the administrator's authenticated session cookies is accepted as legitimate.

An attacker exploits this by hosting a page containing an auto-submitting form or image request that targets the vulnerable settings endpoint. When a logged-in administrator visits the page, their browser transmits session credentials with the forged request. The plugin processes the request and applies the attacker's chosen configuration.

Root Cause

The root cause is the absence of anti-CSRF tokens on privileged actions within the plugin. The vendor did not implement nonce verification or referer validation on the settings form handler. This maps to CWE-352, which describes web applications that accept requests without confirming the request was intentionally submitted by the authenticated user.

Attack Vector

Exploitation requires network access to the target WordPress site and user interaction from an authenticated administrator. The attacker delivers a malicious link through phishing, a compromised site, or a forum post. The victim must be logged into WordPress when they visit the attacker-controlled page. No credentials or prior privileges are required from the attacker. Impact is limited to integrity of plugin configuration and does not directly disclose data or degrade availability.

See the Patchstack Vulnerability Advisory for the disclosure record.

Detection Methods for CVE-2025-30816

Indicators of Compromise

• Unexpected changes to publish-post-email-notification plugin settings recorded in WordPress options table entries
• HTTP POST requests to plugin admin endpoints with Referer headers pointing to external, untrusted domains
• Administrator sessions generating settings-change requests immediately after visiting external links
• Outbound email notification behavior that differs from the last known configured state

Detection Strategies

• Enable WordPress activity logging to capture administrator actions, plugin setting changes, and originating IP addresses
• Alert on POST requests to wp-admin plugin pages that arrive without a matching prior GET from the same session
• Compare plugin option values in wp_options against a known-good baseline on a scheduled basis

Monitoring Recommendations

• Forward WordPress and web server logs to a centralized logging platform for correlation across sessions and referers
• Monitor administrator accounts for browsing behavior that overlaps with active WordPress sessions in the same browser
• Track plugin file integrity and version numbers to confirm patched builds are deployed

How to Mitigate CVE-2025-30816

Immediate Actions Required

• Deactivate the publish-post-email-notification plugin until a patched version is confirmed installed
• Restrict WordPress administrator access to trusted networks or require re-authentication for admin sessions
• Instruct administrators to log out of WordPress before browsing untrusted sites and to use separate browser profiles for admin tasks
• Review plugin settings and revert any unauthorized changes

Patch Information

At the time of publication, the Patchstack advisory lists all versions through 1.0.2.3 as affected. Site owners should monitor the plugin's WordPress.org page for a fixed release and apply it immediately. If no vendor patch is available, virtual patching through a web application firewall is recommended.

Workarounds

• Deploy a web application firewall rule that enforces same-origin Referer validation for POST requests to wp-admin endpoints
• Implement the Patchstack mitigation ruleset or an equivalent virtual patch that inspects requests targeting the plugin's settings handler
• Remove the plugin entirely if email notification functionality can be provided by an alternative, maintained plugin
• Enforce SameSite=Strict or SameSite=Lax on WordPress authentication cookies to reduce cross-site request delivery

# Example nginx rule enforcing same-origin Referer on wp-admin POST requests
location ~ ^/wp-admin/ {
    if ($request_method = POST) {
        set $csrf_block 1;
    }
    if ($http_referer ~* "^https?://your-wordpress-domain\.com/") {
        set $csrf_block 0;
    }
    if ($csrf_block = 1) {
        return 403;
    }
}