CVE-2025-30888: WooCommerce Custom Fields CSRF Vulnerability

CVE-2025-30888 Overview

CVE-2025-30888 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Custom Fields Account Registration For Woocommerce WordPress plugin developed by silverplugins217. The flaw impacts all plugin versions up to and including 1.1. An attacker can craft a malicious web page or link that, when visited by an authenticated user, triggers unintended state-changing actions on the vulnerable WordPress site. The vulnerability is tracked under CWE-352 and requires user interaction to succeed. Successful exploitation results in limited integrity impact without affecting confidentiality or availability.

Critical Impact
An attacker can forge authenticated requests through a victim's browser, modifying plugin state or registration configuration without the victim's consent.

Affected Products

silverplugins217 Custom Fields Account Registration For WooCommerce plugin
All versions from initial release through 1.1
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2025-03-27 - CVE-2025-30888 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30888

Vulnerability Analysis

The vulnerability stems from missing or improperly implemented CSRF protection in the Custom Fields Account Registration For Woocommerce plugin. WordPress provides nonce mechanisms through wp_nonce_field() and check_admin_referer() to validate the origin of state-changing requests. The plugin fails to verify these tokens on one or more request handlers, allowing attacker-controlled origins to submit valid requests through an authenticated user's session.

The attack requires user interaction, meaning a victim with valid credentials must visit a malicious page or click a crafted link. Once triggered, the browser automatically includes session cookies with the forged request. The impact is limited to integrity, indicating that data modification is possible but sensitive information disclosure and service disruption are not direct consequences.

Root Cause

The root cause is the absence of anti-CSRF token validation on request handlers exposed by the plugin. Without nonce verification, the plugin cannot distinguish between legitimate requests originating from the WordPress administrative interface and forged requests triggered by external origins.

Attack Vector

Exploitation follows a standard CSRF pattern. An attacker hosts a page containing an auto-submitting HTML form or image tag targeting the vulnerable plugin endpoint. When an authenticated WordPress user visits the attacker's page, the browser submits the request with the user's cookies attached. The plugin processes the request as legitimate because no nonce check rejects it. Refer to the Patchstack advisory for further technical context.

Detection Methods for CVE-2025-30888

Indicators of Compromise

Unexpected modifications to plugin settings or custom registration field configuration in WooCommerce
Web server access logs showing POST requests to plugin endpoints with Referer headers pointing to external, unrelated domains
Administrator user reports of unintended changes appearing after browsing external sites

Detection Strategies

Inventory WordPress installations and identify sites running Custom Fields Account Registration For Woocommerce version 1.1 or earlier
Review HTTP request logs for state-changing requests to the plugin lacking valid WordPress nonce parameters such as _wpnonce
Correlate administrator session activity with off-site browsing events that precede plugin configuration changes

Monitoring Recommendations

Enable WordPress audit logging to capture plugin configuration changes with user, timestamp, and source IP
Alert on cross-origin Referer values in POST requests targeting /wp-admin/ endpoints associated with the plugin
Monitor for anomalous administrative actions performed shortly after users visit untrusted external URLs

How to Mitigate CVE-2025-30888

Immediate Actions Required

Identify all WordPress sites running the affected plugin version 1.1 or earlier and prioritize remediation
Deactivate the plugin until a patched version is confirmed installed if administrative usage is not business-critical
Instruct administrators to log out of WordPress sessions before browsing untrusted external content

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry for CVE-2025-30888. Site operators should monitor the Patchstack advisory and the plugin's WordPress.org page for a release addressing the missing CSRF protection.

Workarounds

Deploy a Web Application Firewall (WAF) rule to block requests to the plugin endpoints when the Referer header is missing or points to an untrusted origin
Restrict WordPress administrative access to trusted IP ranges using server-level controls such as .htaccess or reverse proxy ACLs
Enforce short session lifetimes and require re-authentication for administrative operations to shrink the CSRF attack window

bash

# Example nginx rule restricting wp-admin access to a trusted network
location ~* /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
}