CVE-2025-30863: Google Sheets Integration CSRF Vulnerability

CVE-2025-30863 Overview

CVE-2025-30863 is a Cross-Site Request Forgery (CSRF) vulnerability in the CRM Perks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms WordPress plugin. The flaw affects all plugin versions up to and including 1.0.9. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, triggers unauthorized state-changing requests on the target site. The vulnerability is categorized under CWE-352 and requires user interaction to succeed. Successful exploitation can result in unauthorized modification of plugin settings tied to form-to-Google-Sheets integrations.

Critical Impact
An attacker can trick an authenticated administrator into submitting forged requests that modify plugin configuration, potentially disrupting form data routing to connected Google Sheets.

Affected Products

CRM Perks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms
Plugin slug: integration-for-contact-form-7-and-google-sheets
All versions from n/a through 1.0.9

Discovery Timeline

2025-03-27 - CVE-2025-30863 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30863

Vulnerability Analysis

The vulnerability stems from missing or inadequate CSRF protection on state-changing endpoints exposed by the plugin. WordPress provides a nonce mechanism (wp_nonce_field, check_admin_referer, wp_verify_nonce) to bind sensitive requests to a specific user session. When these checks are absent, an attacker-controlled page can force the victim's browser to issue authenticated requests to the vulnerable site.

Because the plugin integrates several popular form frameworks including Contact Form 7, WPForms, Elementor, and Ninja Forms, its configuration endpoints handle mappings between form fields and remote Google Sheets destinations. Forged requests targeting these endpoints can alter integration settings without the administrator's consent.

The attack requires an authenticated user, typically an administrator, to visit a crafted URL or web page while logged into WordPress. No credentials or privileges are needed on the attacker's side. The scope is limited to integrity impact, with no direct confidentiality or availability consequences reflected in the vector.

Root Cause

The root cause is the absence of anti-CSRF tokens on administrative actions within the plugin. Requests processed by the plugin do not validate a per-request nonce against the current user's session, allowing cross-origin forged submissions to be accepted as legitimate.

Attack Vector

An attacker hosts a malicious page containing a hidden HTML form or a JavaScript-driven request. The form targets a vulnerable endpoint on the WordPress site. When an authenticated administrator visits the page, the browser automatically attaches the WordPress session cookies to the outgoing request. The vulnerable endpoint processes the request as legitimate and applies the attacker-specified changes to the plugin configuration.

See the Patchstack WordPress Plugin Vulnerability advisory for additional technical details.

Detection Methods for CVE-2025-30863

Indicators of Compromise

Unexpected changes to Google Sheets integration mappings or destination sheet IDs within the plugin settings.
WordPress access logs showing POST requests to plugin admin endpoints without a preceding referral from wp-admin pages.
Administrator sessions submitting plugin configuration requests originating from external Referer headers.

Detection Strategies

Review WordPress wp-admin and admin-ajax.php request logs for state-changing calls to the plugin lacking valid nonce parameters.
Correlate administrator browsing activity with plugin configuration changes to identify off-context modifications.
Deploy a Web Application Firewall (WAF) rule that inspects Referer and Origin headers on plugin admin endpoints.

Monitoring Recommendations

Enable audit logging for WordPress administrator actions using a security plugin or reverse-proxy logging.
Alert on modifications to plugin options in the wp_options table related to Google Sheets integrations.
Monitor outbound traffic from the WordPress host to unfamiliar Google Sheets endpoints or API destinations.

How to Mitigate CVE-2025-30863

Immediate Actions Required

Upgrade the integration-for-contact-form-7-and-google-sheets plugin to a version later than 1.0.9 once released by CRM Perks.
Audit current plugin settings and Google Sheets integration mappings for unauthorized changes.
Require administrators to log out of WordPress sessions when browsing untrusted sites.

Patch Information

At the time of publication, refer to the Patchstack advisory for the latest fixed version and vendor guidance. Apply the vendor patch as soon as it becomes available through the WordPress plugin repository.

Workarounds

Deactivate the plugin until a patched version is installed if Google Sheets integration is not business-critical.
Restrict wp-admin access to trusted IP addresses using web server or WAF rules.
Enforce browser isolation for administrator accounts, ensuring admin sessions are not shared with general web browsing.
Deploy a WAF rule that blocks cross-origin POST requests to plugin admin endpoints.

bash

# Example nginx configuration to restrict wp-admin access by source IP
location ~ ^/wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}