CVE-2025-30967: WPJobBoard CSRF Vulnerability

CVE-2025-30967 Overview

CVE-2025-30967 is a Cross-Site Request Forgery (CSRF) vulnerability in the WPJobBoard WordPress plugin that enables attackers to upload a web shell to a web server. This critical vulnerability allows unauthenticated attackers to chain CSRF with file upload functionality, ultimately achieving Remote Code Execution (RCE) on affected WordPress installations.

Critical Impact

Attackers can leverage this CSRF vulnerability to upload malicious web shells, granting them full control over the affected WordPress server and enabling arbitrary code execution, data theft, and further network compromise.

Affected Products

• WPJobBoard WordPress plugin version 5.11.1 and prior
• WordPress installations utilizing the vulnerable WPJobBoard plugin
• Web servers hosting affected WordPress sites

Discovery Timeline

• 2025-04-15 - CVE-2025-30967 published to NVD
• 2025-04-16 - Last updated in NVD database

Technical Details for CVE-2025-30967

Vulnerability Analysis

This vulnerability stems from a lack of proper CSRF token validation in the WPJobBoard plugin's file upload functionality. When an authenticated administrator is tricked into visiting a malicious page or clicking a crafted link, the attacker can exploit the missing anti-CSRF protections to submit unauthorized file upload requests on behalf of the victim.

The attack chain involves two stages: first exploiting the CSRF weakness to bypass authentication checks, then leveraging the file upload mechanism to deploy a PHP web shell. Once uploaded, the web shell provides the attacker with a persistent backdoor for executing arbitrary commands on the server with the privileges of the web server process.

The scope-changing nature of this vulnerability means that successful exploitation impacts resources beyond the vulnerable component itself, potentially compromising the entire WordPress installation and underlying server infrastructure.

Root Cause

The root cause is classified under CWE-352 (Cross-Site Request Forgery). The WPJobBoard plugin fails to implement proper nonce verification or anti-CSRF tokens in its file upload handling endpoints. This allows attackers to craft malicious requests that execute privileged actions when processed by an authenticated administrator's browser session.

WordPress provides built-in CSRF protection mechanisms through nonces, but the vulnerable code paths in WPJobBoard do not properly validate these tokens before processing file upload requests.

Attack Vector

The attack requires network access and user interaction. An attacker must trick an authenticated WordPress administrator into visiting a malicious webpage containing a crafted form or script. The malicious page automatically submits a file upload request to the vulnerable WPJobBoard endpoint, using the administrator's active session to bypass authentication.

The attack sequence involves crafting an HTML page containing a hidden form that targets the vulnerable file upload endpoint, including a malicious PHP file payload. When an authenticated admin visits the page, their browser automatically submits the request with their session cookies, uploading the web shell to the server.

Detection Methods for CVE-2025-30967

Indicators of Compromise

• Unexpected PHP files appearing in WordPress upload directories or plugin folders
• Web shell files with suspicious names or obfuscated content (e.g., shell.php, c99.php, r57.php)
• Unusual outbound network connections from the web server process
• Modified .htaccess files or unexpected cron jobs
• Access logs showing requests to newly created PHP files from external IP addresses

Detection Strategies

• Monitor WordPress upload directories for newly created PHP files
• Implement file integrity monitoring to detect unauthorized changes to plugin directories
• Review web server access logs for suspicious POST requests to WPJobBoard endpoints
• Deploy Web Application Firewalls (WAF) with rules to detect web shell upload attempts
• Scan uploaded files for known web shell signatures and obfuscated PHP code patterns

Monitoring Recommendations

• Enable WordPress audit logging to track administrative actions and file uploads
• Configure alerts for new PHP file creation in web-accessible directories
• Monitor for unusual process execution originating from the web server user
• Implement real-time security monitoring with SentinelOne Singularity for endpoint detection
• Review authentication logs for sessions coinciding with suspicious file operations

How to Mitigate CVE-2025-30967

Immediate Actions Required

• Update WPJobBoard to a patched version immediately if one is available
• Temporarily disable the WPJobBoard plugin until a patch is applied
• Audit WordPress installations for any signs of existing compromise
• Review and remove any suspicious PHP files from upload directories
• Implement additional WAF rules to block CSRF-based file upload attempts

Patch Information

Refer to the Patchstack WP Job Board Vulnerability advisory for the latest patch information and version updates. Contact the plugin vendor for patched versions and apply updates through the WordPress admin dashboard or manually via SFTP.

Workarounds

• Disable the WPJobBoard plugin entirely until a security patch is available
• Implement a Web Application Firewall (WAF) to filter malicious file upload requests
• Restrict administrative access to trusted IP addresses only
• Enable two-factor authentication for all WordPress administrator accounts
• Configure server-level restrictions to prevent PHP execution in upload directories

# Prevent PHP execution in WordPress uploads directory
# Add to .htaccess in wp-content/uploads/
<FilesMatch "\.php$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Alternative: Disable PHP execution via Apache configuration
<Directory "/var/www/html/wp-content/uploads">
    php_admin_flag engine off
</Directory>