CVE-2025-30830: Cool Author Box Auth Bypass Vulnerability

CVE-2025-30830 Overview

CVE-2025-30830 is a missing authorization vulnerability in the Hossni Mubarak Cool Author Box plugin (hm-cool-author-box-widget) for WordPress. The flaw affects all versions up to and including 2.9.9. Attackers can exploit incorrectly configured access control security levels to reach plugin functions that should be restricted. The issue is categorized under CWE-862: Missing Authorization.

The vulnerability requires no authentication and can be triggered over the network with low attack complexity. Successful exploitation results in limited disclosure of information handled by the plugin.

Critical Impact
Unauthenticated network attackers can invoke plugin functionality that lacks capability checks, leading to information exposure on affected WordPress sites.

Affected Products

Cool Author Box WordPress plugin (hm-cool-author-box-widget) versions up to and including 2.9.9
WordPress sites running the vulnerable plugin
Hossni Mubarak Cool Author Box distributions from the WordPress plugin directory

Discovery Timeline

2025-03-27 - CVE-2025-30830 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30830

Vulnerability Analysis

The Cool Author Box plugin exposes one or more actions that fail to verify the requester's authorization before executing sensitive logic. Missing authorization vulnerabilities in WordPress plugins typically occur when AJAX endpoints, REST routes, or admin-post handlers are registered without a corresponding current_user_can() or capability check. The plugin's access control relies on incorrectly configured security levels rather than explicit capability enforcement.

Because the attack vector is network-based and no privileges are required, an attacker only needs to send crafted HTTP requests to the target WordPress site. The impact is limited to confidentiality, with integrity and availability unaffected. This aligns with the plugin's role as a display widget where callable functions may return author or configuration data intended for privileged users.

Root Cause

The root cause is the absence of proper authorization checks on plugin endpoints. Under CWE-862, the software does not perform an authorization check when an actor attempts to access a resource or perform an action. Refer to the Patchstack Vulnerability Report for technical specifics on the affected handlers.

Attack Vector

An unauthenticated remote attacker sends HTTP requests directly to the plugin's exposed endpoints. Because no user interaction or authentication is required, exploitation can be automated across WordPress sites that expose the plugin's action handlers. No verified proof-of-concept code is publicly available at this time.

Detection Methods for CVE-2025-30830

Indicators of Compromise

Anomalous unauthenticated requests targeting admin-ajax.php or REST routes associated with hm-cool-author-box-widget
Repeated HTTP requests from a single IP enumerating plugin endpoints
Web server access logs showing successful responses to plugin actions from unauthenticated sessions

Detection Strategies

Inventory WordPress installations for the hm-cool-author-box-widget plugin and identify versions at or below 2.9.9
Monitor web application firewall logs for requests to plugin-specific action names without valid nonces or session cookies
Correlate WordPress audit logs with edge proxy logs to detect access patterns inconsistent with authenticated administrators

Monitoring Recommendations

Enable verbose logging on wp-admin/admin-ajax.php and REST API endpoints registered by the plugin
Alert on HTTP 200 responses to plugin endpoints originating from unauthenticated sources
Track outbound data volumes from WordPress sites to detect information exposure patterns

How to Mitigate CVE-2025-30830

Immediate Actions Required

Identify all WordPress sites running Cool Author Box version 2.9.9 or earlier
Deactivate the plugin until a patched version is confirmed available from the vendor
Apply the fixed release referenced in the Patchstack Vulnerability Report once published
Review WordPress access logs for evidence of prior exploitation attempts against plugin endpoints

Patch Information

At the time of publication, the NVD entry indicates the vulnerability affects Cool Author Box from n/a through 2.9.9. Administrators should consult the vendor's plugin page and the Patchstack advisory for the fixed version and apply it through the WordPress plugin update mechanism.

Workarounds

Remove or deactivate the hm-cool-author-box-widget plugin if a patched version is not yet available
Deploy WAF rules that block unauthenticated requests to the plugin's AJAX and REST endpoints
Restrict access to wp-admin/admin-ajax.php action names associated with the plugin using server-level ACLs

bash

# Example WAF rule concept blocking unauthenticated access to plugin AJAX actions
# Adapt to your WAF syntax before deployment
SecRule REQUEST_URI "@contains admin-ajax.php" \
  "chain,deny,status:403,id:1009830,msg:'Block Cool Author Box unauthenticated action'"
SecRule ARGS:action "@rx ^hm_cool_author_box_" \
  "chain"
SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"