CVE-2025-30872: WooCommerce Product Author CSRF Flaw

CVE-2025-30872 Overview

CVE-2025-30872 is a Cross-Site Request Forgery (CSRF) vulnerability in the Nitin Prakash Product Author for WooCommerce WordPress plugin (wc-product-author). The flaw affects all versions up to and including 1.0.7. An attacker can trick an authenticated user into submitting forged requests that perform unintended state-changing actions on the WooCommerce store. The vulnerability is classified under CWE-352 and requires user interaction to succeed. According to Patchstack, the flaw stems from missing or insufficient CSRF token validation on privileged plugin endpoints.

Critical Impact
Attackers can forge requests that modify plugin state on behalf of authenticated WooCommerce administrators, potentially altering product author metadata without consent.

Affected Products

Nitin Prakash Product Author for WooCommerce (wc-product-author) plugin
All versions from n/a through 1.0.7
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2025-03-27 - CVE-2025-30872 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30872

Vulnerability Analysis

The vulnerability exists in the Product Author for WooCommerce plugin, which extends WooCommerce to associate authors with products. The plugin exposes state-changing actions that do not adequately verify the origin of incoming requests. An attacker can craft a malicious HTML page or link that submits a request to the vulnerable plugin endpoint. If an authenticated administrator visits the attacker-controlled page, their browser will submit the request with valid session cookies. The server processes the request as legitimate because no anti-CSRF token or referrer check blocks it. The EPSS score of 0.197% indicates low current exploitation probability, but the attack requires only social engineering to trigger.

Root Cause

The root cause is missing CSRF protection on plugin action handlers. Standard WordPress nonce validation using wp_verify_nonce() or the check_admin_referer() helper is either absent or improperly implemented in the affected handlers. Without this validation, the plugin cannot distinguish between a request submitted intentionally by an administrator and one triggered by an external site.

Attack Vector

Exploitation requires an authenticated WordPress user, typically an administrator, to interact with attacker-controlled content. The attacker hosts a malicious page containing a hidden form or img tag targeting the vulnerable plugin endpoint. When the victim visits the page while logged into the WordPress admin, the browser transmits authenticated cookies with the forged request. The plugin processes the action as if the administrator initiated it. Refer to the Patchstack Vulnerability Report for full technical detail.

Detection Methods for CVE-2025-30872

Indicators of Compromise

Unexpected changes to product author metadata in WooCommerce product records without corresponding audit log entries
HTTP POST requests to plugin endpoints with Referer headers pointing to external, untrusted domains
Administrator sessions showing plugin actions immediately after visits to unfamiliar external URLs

Detection Strategies

Inspect web server access logs for requests to wc-product-author plugin endpoints containing off-site Referer values
Enable WordPress audit logging plugins to record all administrative actions and correlate them with user navigation history
Review plugin version inventory across managed WordPress sites and flag any host running wc-product-author at version 1.0.7 or below

Monitoring Recommendations

Alert on WooCommerce configuration changes that occur outside expected administrator working hours
Monitor outbound admin browser traffic for unexpected cross-origin form submissions to the WordPress admin surface
Track plugin file integrity to detect any accompanying tampering that may follow a successful CSRF-driven change

How to Mitigate CVE-2025-30872

Immediate Actions Required

Deactivate the Product Author for WooCommerce plugin on any site running version 1.0.7 or earlier until a patched release is confirmed
Require administrators to log out of the WordPress admin console when not in active use to reduce the CSRF exposure window
Restrict WordPress admin access to trusted IP ranges via web server or WAF rules

Patch Information

At the time of publication, no fixed version is listed in the CVE record. Site owners should monitor the Patchstack Vulnerability Report and the plugin's WordPress.org repository page for an update beyond 1.0.7 that introduces proper nonce validation.

Workarounds

Deploy a Web Application Firewall (WAF) rule that enforces same-origin Referer and Origin headers on requests to plugin admin endpoints
Use browser session isolation, dedicating a browser profile solely for WordPress administration to limit exposure to attacker-controlled tabs
Install a WordPress security plugin that adds global nonce enforcement or blocks cross-origin admin POST requests

bash

# Example nginx rule to block cross-origin POSTs to the plugin endpoint
location ~* /wp-admin/admin\.php {
    if ($request_method = POST) {
        set $csrf_check "";
        if ($http_origin !~* "^https?://your-domain\.com") { set $csrf_check "1"; }
        if ($csrf_check = "1") { return 403; }
    }
}