CVE-2025-30862: reCAPTCHA for all CSRF Vulnerability

CVE-2025-30862 Overview

CVE-2025-30862 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the reCAPTCHA for all WordPress plugin by sminozzi. The flaw exists in all versions up to and including 2.22. An attacker can trick an authenticated user into submitting a forged request that performs actions in the plugin without the user's consent. The weakness is classified as [CWE-352] and requires user interaction to succeed. Successful exploitation impacts integrity but does not directly expose confidential data or crash the site.

Critical Impact
Attackers can leverage social engineering to force authenticated WordPress users to submit unauthorized state-changing requests to the reCAPTCHA for all plugin, altering plugin configuration.

Affected Products

WordPress plugin: sminozzi reCAPTCHA for all (recaptcha-for-all)
All versions from n/a through 2.22
WordPress sites with the vulnerable plugin activated

Discovery Timeline

2025-03-27 - CVE-2025-30862 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30862

Vulnerability Analysis

The vulnerability stems from missing or improper CSRF protection in the recaptcha-for-all plugin. Plugin request handlers do not validate anti-CSRF tokens (WordPress nonces) or verify the origin of state-changing requests. An attacker who lures a logged-in administrator or privileged user to a malicious page can trigger unauthorized actions in the plugin context.

The attack is delivered over the network and requires user interaction, such as clicking a crafted link or visiting an attacker-controlled site. No authentication credentials are needed by the attacker because the victim's browser supplies session cookies automatically. The scope is unchanged and confidentiality and availability impacts are not present, but integrity can be modified within plugin settings.

Root Cause

The root cause is the absence of nonce verification on sensitive plugin endpoints. WordPress provides wp_nonce_field() and check_admin_referer() primitives for CSRF protection. The plugin's affected handlers do not enforce these checks, allowing cross-origin submissions to execute as if initiated by the authenticated user.

Attack Vector

An attacker hosts a malicious page containing a hidden form or JavaScript that auto-submits a request to the target WordPress site's plugin endpoint. When a logged-in site administrator visits the page, the browser submits the request with valid session cookies. The plugin processes the request without validating its origin, applying configuration changes chosen by the attacker. See the Patchstack Vulnerability Analysis for further technical detail.

Detection Methods for CVE-2025-30862

Indicators of Compromise

Unexpected changes to recaptcha-for-all plugin configuration or option values in wp_options
HTTP POST requests to plugin admin endpoints with Referer headers pointing to external domains
WordPress admin audit log entries showing setting modifications outside normal maintenance windows

Detection Strategies

Monitor web server access logs for POST requests to /wp-admin/admin.php?page=recaptcha-for-all* originating with foreign Referer or Origin headers
Enable WordPress activity logging plugins to record plugin setting changes and correlate with user session activity
Alert on plugin option changes that occur without a corresponding admin page load from the same user session

Monitoring Recommendations

Track outbound clicks and email content flagged with WordPress admin URLs targeting privileged users
Review WAF logs for CSRF-pattern requests missing valid _wpnonce parameters
Baseline expected administrator activity and alert on off-hours plugin configuration writes

How to Mitigate CVE-2025-30862

Immediate Actions Required

Update the recaptcha-for-all plugin to a version later than 2.22 as soon as the vendor releases a patched build
If no patched version is available, deactivate and remove the plugin from affected WordPress sites
Require administrators to log out of WordPress sessions when browsing untrusted sites, and enforce short session lifetimes

Patch Information

At the time of publication, the vendor advisory tracked by Patchstack indicates the vulnerability affects versions up to and including 2.22. Site owners should consult the Patchstack Vulnerability Analysis for the current fixed version and upgrade instructions.

Workarounds

Deploy a Web Application Firewall rule that blocks state-changing requests to plugin endpoints lacking a valid _wpnonce parameter and matching Referer header
Restrict access to /wp-admin/ by IP allowlist for administrator accounts
Apply the principle of least privilege by limiting the number of accounts with plugin configuration permissions

bash

# Example WAF rule (ModSecurity) blocking CSRF against the plugin admin page
SecRule REQUEST_METHOD "@streq POST" \
    "chain,phase:2,deny,status:403,id:1030862,\
     msg:'Possible CSRF against recaptcha-for-all plugin'"
  SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
    "chain"
    SecRule ARGS:page "@rx recaptcha-for-all" \
      "chain"
      SecRule &ARGS:_wpnonce "@eq 0"