CVE-2025-30923 Overview
CVE-2025-30923 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Gift Message for WooCommerce plugin developed by powerfulwp for WordPress. The flaw exists in all plugin versions up to and including 1.7.8. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, triggers unauthorized state-changing requests against the plugin. The issue is categorized under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction such as clicking a crafted link while authenticated to the target site.
Critical Impact
Successful exploitation allows an attacker to induce authenticated users to perform unintended state-changing actions on WooCommerce sites running the vulnerable plugin, resulting in limited integrity impact.
Affected Products
- powerfulwp Gift Message for WooCommerce plugin (gift-message-for-woocommerce)
- All versions from n/a through <= 1.7.8
- WordPress sites running WooCommerce with this plugin installed
Discovery Timeline
- 2025-03-27 - CVE-2025-30923 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30923
Vulnerability Analysis
The Gift Message for WooCommerce plugin fails to validate the origin of state-changing HTTP requests. The plugin does not enforce anti-CSRF tokens (WordPress nonces) or does not verify them correctly on sensitive endpoints. An attacker who can lure an authenticated site administrator or privileged user to a controlled page can trigger requests that the plugin processes as legitimate. The vulnerability requires user interaction, as reflected in the CVSS vector component UI:R. The EPSS probability is 0.181%, indicating a low observed likelihood of exploitation activity at this time.
Root Cause
The root cause is missing or improperly implemented CSRF protection on plugin actions. WordPress provides wp_nonce_field() and check_admin_referer() / wp_verify_nonce() primitives for this purpose. The affected plugin versions do not consistently apply these controls before processing requests that modify plugin configuration or data, as documented in the Patchstack Vulnerability Report.
Attack Vector
The attack is network-based and requires no authentication from the attacker. The attacker hosts a page containing a forged form or JavaScript that submits a request to the vulnerable WordPress site. When an authenticated victim visits the page, their browser automatically attaches session cookies, and the request executes with the victim's privileges. No verified exploit code or public proof-of-concept is available at publication time.
// No verified proof-of-concept code is publicly available.
// Refer to the Patchstack advisory for technical details.
Detection Methods for CVE-2025-30923
Indicators of Compromise
- Unexpected changes to Gift Message for WooCommerce plugin settings without corresponding administrator activity in audit logs.
- HTTP POST or GET requests to plugin endpoints where the Referer header points to an external, untrusted domain.
- Administrator sessions producing state-changing plugin requests immediately after visiting external links.
Detection Strategies
- Review WordPress access logs for requests to plugin admin endpoints that lack a valid nonce parameter.
- Correlate browser session activity with plugin configuration changes to identify requests originating from third-party sites.
- Deploy a Web Application Firewall (WAF) rule that inspects the Referer and Origin headers on plugin management endpoints.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record all administrator-initiated configuration changes.
- Monitor for outbound clicks from administrator accounts to untrusted domains during authenticated sessions.
- Alert on plugin setting modifications occurring outside standard maintenance windows.
How to Mitigate CVE-2025-30923
Immediate Actions Required
- Update the Gift Message for WooCommerce plugin to a version later than 1.7.8 once released by powerfulwp.
- Restrict administrator browsing habits during authenticated sessions to trusted sites only.
- Enforce least-privilege on WooCommerce store user roles to reduce the blast radius of a successful CSRF.
Patch Information
Refer to the Patchstack advisory for the latest fixed version information. Users should monitor the plugin's WordPress.org listing for updates addressing versions after 1.7.8.
Workarounds
- Deactivate and remove the Gift Message for WooCommerce plugin until a patched version is available.
- Deploy a WAF rule that blocks requests to the plugin's admin endpoints when the Origin or Referer header does not match the site domain.
- Require re-authentication for administrator sessions using a short session timeout to reduce the CSRF window.
# Example: disable the vulnerable plugin via WP-CLI until a patch is applied
wp plugin deactivate gift-message-for-woocommerce
wp plugin uninstall gift-message-for-woocommerce
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
