CVE-2025-30965: WPJobBoard CSRF Vulnerability

CVE-2025-30965 Overview

CVE-2025-30965 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WPJobBoard plugin for WordPress. The flaw is tracked under CWE-352 and stems from missing or improperly validated anti-CSRF tokens on plugin request handlers. An attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user, triggers unintended state-changing actions in the plugin. Exploitation requires user interaction but does not require any authentication on the attacker's side. The issue was documented by Patchstack and impacts WPJobBoard versions up to 5.11.1.

Critical Impact
Attackers can trick authenticated users into performing unwanted actions in the WPJobBoard plugin, resulting in limited integrity impact on WordPress sites that host the plugin.

Affected Products

WPJobBoard WordPress plugin (through version 5.11.1)
WordPress installations with WPJobBoard enabled
Sites where administrators or privileged users interact with untrusted web content

Discovery Timeline

2025-04-15 - CVE-2025-30965 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30965

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery weakness [CWE-352] in the WPJobBoard plugin. CSRF flaws occur when a web application fails to verify that a state-changing request was intentionally submitted by the authenticated user. In this case, WPJobBoard request handlers do not validate a nonce or anti-CSRF token before processing sensitive actions. An attacker hosts a crafted page containing an HTML form or JavaScript that submits a forged request to the vulnerable endpoint. When an authenticated WordPress user visits the page, the browser automatically attaches the user's session cookies to the request. The plugin then processes the request as if it originated from the legitimate user.

Root Cause

The root cause is missing or improperly implemented CSRF protection on plugin action handlers. WordPress provides wp_nonce_field() and check_admin_referer() primitives to prevent CSRF, but the affected WPJobBoard handlers did not consistently enforce these checks. Requests are accepted based solely on session cookies, which browsers attach to cross-origin requests by default.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker delivers a malicious URL through phishing, a forum post, or an attacker-controlled site. When an authenticated WPJobBoard user visits the page, a hidden request is issued to the target WordPress site, triggering a plugin action under the victim's privileges. No credentials are needed by the attacker and no prior access to the site is required. See the Patchstack WP Job Board Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-30965

Indicators of Compromise

Unexpected changes to WPJobBoard configuration, job listings, or application data made from legitimate admin accounts.
Web server access logs showing state-changing POST requests to WPJobBoard endpoints with Referer headers pointing to external, untrusted domains.
Administrative actions occurring near timestamps when a privileged user browsed external sites.

Detection Strategies

Review WordPress audit logs for plugin actions that lack a corresponding user-initiated admin session.
Inspect HTTP request logs for POST requests to WPJobBoard action handlers missing valid _wpnonce parameters.
Correlate browser activity of privileged users with unexpected write operations against the WordPress database.

Monitoring Recommendations

Enable a WordPress audit logging plugin to track admin-level configuration changes.
Monitor web application firewall (WAF) logs for cross-origin POST requests targeting /wp-admin/admin.php and /wp-admin/admin-post.php with WPJobBoard-specific actions.
Alert on unusual Referer or Origin headers on privileged plugin endpoints.

How to Mitigate CVE-2025-30965

Immediate Actions Required

Update the WPJobBoard plugin to the latest patched release as published by the vendor.
Require administrators to log out of the WordPress admin panel when not actively performing management tasks.
Train privileged users to avoid clicking untrusted links while authenticated to WordPress.

Patch Information

Refer to the Patchstack advisory for WPJobBoard for the fixed version. Apply the vendor update through the WordPress plugin manager or by replacing the plugin files manually. Verify integrity after upgrade and clear any cached admin pages.

Workarounds

Deploy a WAF rule that blocks POST requests to WPJobBoard endpoints when the Origin or Referer header does not match the site's own domain.
Restrict access to /wp-admin/ by IP allowlist for administrator accounts where feasible.
Disable the WPJobBoard plugin until the patched version is applied if the site does not actively require its functionality.

bash

# Example nginx snippet to enforce same-origin Referer on plugin admin actions
location ~ ^/wp-admin/admin(-post)?\.php$ {
    if ($http_referer !~* "^https?://example\.com/") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}