CVE-2025-30856: WP Job Manager Custom Field CSRF Flaw

CVE-2025-30856 Overview

CVE-2025-30856 is a Cross-Site Request Forgery (CSRF) vulnerability in the Custom Field For WP Job Manager WordPress plugin developed by theme funda. The flaw affects all versions up to and including 1.4. An attacker can trick an authenticated user into submitting a forged request that performs unintended actions on the WordPress site. The vulnerability is tracked under CWE-352 and requires user interaction to succeed.

Critical Impact
Successful exploitation allows attackers to perform unauthorized state-changing actions in the plugin on behalf of an authenticated administrator, resulting in limited integrity impact to WordPress sites running the vulnerable plugin.

Affected Products

theme funda Custom Field For WP Job Manager plugin for WordPress
All plugin versions from unspecified initial release through 1.4
WordPress installations with the custom-field-for-wp-job-manager plugin activated

Discovery Timeline

2025-03-27 - CVE-2025-30856 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30856

Vulnerability Analysis

The Custom Field For WP Job Manager plugin fails to implement adequate CSRF protection on one or more state-changing endpoints. WordPress plugins typically defend against CSRF using nonce tokens generated by wp_create_nonce() and validated with check_admin_referer() or wp_verify_nonce(). The absence or improper validation of these tokens allows forged requests originating from an attacker-controlled site to execute plugin actions in the context of an authenticated session.

An attacker who convinces a logged-in administrator to visit a malicious page can trigger requests that modify plugin data. The scope is limited to actions exposed by the plugin, and confidentiality and availability are not impacted. The vulnerability requires user interaction, meaning the victim must be authenticated and must load the attacker's payload.

Root Cause

The root cause is missing or insufficient anti-CSRF token validation on plugin request handlers. Without a per-request nonce verified against the current user's session, the plugin cannot distinguish between requests intentionally submitted through the WordPress admin interface and requests forged by a third-party origin.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker hosts a page containing a hidden form or JavaScript that submits a request to the vulnerable plugin endpoint. When an authenticated WordPress administrator visits the page, the browser attaches the WordPress session cookies to the outgoing request, and the plugin processes it as legitimate. Refer to the Patchstack advisory for further technical context.

Detection Methods for CVE-2025-30856

Indicators of Compromise

Unexpected modifications to custom field configurations within the WP Job Manager plugin
HTTP referer headers on plugin admin requests pointing to external, untrusted domains
Administrator sessions triggering plugin state changes without corresponding admin panel navigation in access logs

Detection Strategies

Review web server access logs for POST requests to /wp-admin/ endpoints associated with the custom-field-for-wp-job-manager plugin that originate from external referers
Audit WordPress admin activity logs for unauthorized changes to plugin settings or custom field definitions
Deploy a web application firewall (WAF) rule set that flags requests to plugin endpoints missing the expected _wpnonce parameter

Monitoring Recommendations

Enable and centralize WordPress audit logging to capture administrative actions with source IP and referer metadata
Alert on administrator-context requests to plugin URLs where the referer does not match the site's own domain
Monitor for anomalous browser-initiated form submissions from administrator accounts outside normal working hours

How to Mitigate CVE-2025-30856

Immediate Actions Required

Deactivate the Custom Field For WP Job Manager plugin until a patched version is available and verified
Restrict WordPress administrator access to trusted networks using IP allowlisting on /wp-admin/
Require administrators to use isolated browser sessions or dedicated browsers when managing WordPress

Patch Information

At the time of publication, the vendor advisory referenced by Patchstack lists all versions through 1.4 as vulnerable. Administrators should monitor the plugin's WordPress.org listing and update to any release higher than 1.4 that explicitly addresses CVE-2025-30856.

Workarounds

Remove the plugin from production sites if the custom fields functionality is not business-critical
Deploy a WAF rule that enforces presence and validity of the _wpnonce parameter on plugin admin actions
Instruct administrators to log out of WordPress sessions when not actively managing the site to reduce the window for CSRF exploitation

bash

# Example WAF rule (ModSecurity) to block plugin admin requests missing a nonce
SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
    "chain,deny,status:403,id:1030856,msg:'CVE-2025-30856 CSRF protection'"
    SecRule ARGS:page "@streq custom-field-for-wp-job-manager" \
        "chain"
        SecRule &ARGS:_wpnonce "@eq 0"