CVE-2025-30866: Terms & Conditions Auth Bypass Flaw

CVE-2025-30866 Overview

CVE-2025-30866 is a Missing Authorization vulnerability [CWE-862] in the Giannis Kipouros Terms & Conditions Per Product WordPress plugin. The flaw affects all versions up to and including 1.2.15. The plugin fails to enforce proper access control checks on one or more actions, allowing unauthenticated network attackers to interact with functionality intended for privileged users. Successful exploitation results in a limited integrity impact on the target WordPress site. No user interaction or authentication is required to trigger the issue.

Critical Impact
Unauthenticated attackers can invoke restricted plugin actions over the network, modifying data managed by the terms-and-conditions-per-product plugin without valid authorization.

Affected Products

Giannis Kipouros Terms & Conditions Per Product plugin for WordPress
All versions from initial release through 1.2.15
WordPress sites using the terms-and-conditions-per-product plugin slug

Discovery Timeline

2025-03-27 - CVE-2025-30866 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30866

Vulnerability Analysis

The vulnerability is classified as Missing Authorization under [CWE-862]. The plugin exposes actions that perform sensitive operations without verifying whether the requesting user holds the required capability or role. WordPress plugins typically must call current_user_can() or verify a valid nonce with check_admin_referer() before executing privileged actions. When these checks are absent, any visitor can trigger the action by sending crafted HTTP requests to the exposed endpoint.

The scope of impact is limited to integrity. Confidentiality and availability are not affected, according to the CVSS vector. This indicates the vulnerable code paths modify plugin-managed data rather than expose sensitive information or crash the site. The EPSS probability is 0.471% at the 37.6 percentile as of 2026-07-14.

Root Cause

The plugin's action handlers do not perform capability checks before executing state-changing operations. Endpoints registered through WordPress hooks such as admin_post_*, wp_ajax_nopriv_*, or REST routes lack the permission_callback or current_user_can() guards required to restrict access to authenticated administrators.

Attack Vector

An unauthenticated attacker sends an HTTP request directly to the vulnerable plugin endpoint on a target WordPress site. Because there is no authorization check, the plugin processes the request and modifies its stored configuration or product terms data. The attack requires only network reachability to the WordPress admin-ajax or admin-post interface. No user interaction, credentials, or elevated privileges are needed.

Refer to the Patchstack Vulnerability Report for endpoint-level details.

Detection Methods for CVE-2025-30866

Indicators of Compromise

Unexpected modifications to term and condition entries associated with WooCommerce or WordPress products managed by the plugin.
HTTP POST requests to /wp-admin/admin-ajax.php or /wp-admin/admin-post.php referencing plugin actions from unauthenticated sessions.
WordPress option or post meta changes tied to the terms-and-conditions-per-product plugin without a corresponding admin login event.

Detection Strategies

Inspect web server access logs for requests to plugin action endpoints originating from clients without valid wordpress_logged_in_* cookies.
Compare current plugin database entries against known-good backups to identify unauthorized changes.
Alert on high request volumes to admin-ajax.php referencing plugin-specific action parameters.

Monitoring Recommendations

Enable a web application firewall rule set that flags unauthenticated access to WordPress admin endpoints.
Forward WordPress audit logs to a centralized SIEM and correlate plugin data modifications with authentication events.
Monitor file integrity and database change events for the affected plugin's tables and options.

How to Mitigate CVE-2025-30866

Immediate Actions Required

Identify all WordPress sites running terms-and-conditions-per-product version 1.2.15 or earlier.
Deactivate the plugin until a vendor-supplied fix is available and verified.
Restrict access to /wp-admin/ and admin-ajax.php from untrusted networks where possible.
Review plugin-managed data for unauthorized modifications and restore from backup if tampering is confirmed.

Patch Information

At the time of publication, no fixed version beyond 1.2.15 is referenced in the available advisory data. Monitor the Patchstack Vulnerability Report and the WordPress plugin repository for an updated release from the vendor. Apply the patched version immediately once it becomes available.

Workarounds

Deactivate and remove the terms-and-conditions-per-product plugin until a fixed version is released.
Deploy a virtual patching rule through a WordPress security plugin or WAF to block unauthenticated requests to the plugin's action handlers.
Enforce IP allow-listing on the WordPress administration interface to reduce exposure to unauthenticated attackers.

bash

# Example Apache rule to block unauthenticated access to the plugin's ajax actions
# Adjust the action name to match the vulnerable handler identified in the advisory
<LocationMatch "/wp-admin/admin-ajax.php">
    RewriteEngine On
    RewriteCond %{QUERY_STRING} action=tcpp_[a-z_]+ [NC,OR]
    RewriteCond %{HTTP_COOKIE} !wordpress_logged_in_
    RewriteRule ^ - [F,L]
</LocationMatch>