CVE-2025-30912: Float Menu Plugin CSRF Vulnerability

CVE-2025-30912 Overview

CVE-2025-30912 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Wow-Company Float menu plugin for WordPress. The flaw impacts all plugin versions up to and including 6.1.2. An attacker can craft a malicious request that, when triggered by an authenticated administrator visiting an attacker-controlled page, alters plugin settings without consent. The weakness is classified under [CWE-352] Cross-Site Request Forgery. Exploitation requires user interaction, and successful attacks can modify plugin configuration, affecting integrity and availability of the WordPress site.

Critical Impact
An authenticated administrator visiting a malicious page can be forced to submit unintended requests, resulting in unauthorized modification of Float menu plugin settings.

Affected Products

Wow-Company Float menu WordPress plugin
All versions up to and including 6.1.2
WordPress sites with Float menu installed and activated

Discovery Timeline

2025-03-27 - CVE-2025-30912 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30912

Vulnerability Analysis

The Float menu plugin fails to validate the origin and authenticity of state-changing requests submitted to its settings handlers. The plugin does not enforce anti-CSRF token verification, commonly implemented in WordPress through wp_nonce_field() and check_admin_referer(). Without these validations, the plugin cannot distinguish between legitimate administrator-initiated requests and forged requests originating from external domains.

An attacker leverages this by hosting a crafted page containing a form or script that submits a settings-change request to the target WordPress site. When an authenticated administrator visits that page, the browser automatically includes session cookies, and the plugin processes the request as if the administrator initiated it. This results in unauthorized configuration changes to the Float menu component.

Root Cause

The root cause is missing CSRF protection [CWE-352] on the plugin's settings endpoints. The handler processes POST requests without verifying a nonce token or the HTTP Referer, allowing forged cross-origin requests to succeed when accompanied by valid session cookies.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker must lure an authenticated WordPress administrator to a page under attacker control. The forged request executes with administrator privileges, changing plugin behavior or content displayed on the site. Refer to the Patchstack WordPress Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-30912

Indicators of Compromise

Unexpected changes to Float menu plugin settings in the WordPress database (wp_options entries).
HTTP POST requests to Float menu admin endpoints originating from external Referer headers.
Administrator sessions submitting settings updates without preceding admin page navigation in access logs.

Detection Strategies

Review web server access logs for POST requests to wp-admin Float menu endpoints with off-site or missing Referer values.
Audit WordPress activity logs for settings modifications that do not correspond to administrator workflow patterns.
Compare plugin configuration snapshots against known-good baselines to identify unauthorized drift.

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture plugin settings changes with timestamps and originating user context.
Alert on administrator account activity that occurs shortly after visiting external URLs during the same browser session.
Monitor for repeated failed or anomalous requests targeting the Float menu plugin's admin-ajax or options endpoints.

How to Mitigate CVE-2025-30912

Immediate Actions Required

Update the Float menu plugin to a version released after 6.1.2 that addresses the CSRF issue, once available from the vendor.
Restrict WordPress administrator accounts from browsing untrusted sites during active admin sessions.
Enforce short session lifetimes and require re-authentication for sensitive administrative actions.

Patch Information

Refer to the Patchstack advisory for the Float menu plugin for current patch availability and update guidance. Administrators should verify plugin version after updating and confirm settings integrity.

Workarounds

Deactivate the Float menu plugin until a patched version is installed if the functionality is not business-critical.
Deploy a web application firewall (WAF) rule to block requests to plugin admin endpoints lacking a valid same-origin Referer header.
Require administrators to use a dedicated browser profile for WordPress management, isolated from general web browsing.

bash

# Example WAF rule concept: reject POSTs to plugin admin endpoints from external referers
# ModSecurity pseudo-rule
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1009120,msg:'CSRF block: Float menu settings'"
  SecRule REQUEST_URI "@contains /wp-admin/admin.php?page=float-menu" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-wordpress-site.example/"