CVE-2025-30980 Overview
CVE-2025-30980 is a Cross-Site Request Forgery (CSRF) vulnerability in the Simple Keyword to Link WordPress plugin developed by Alessandro Piconi. The flaw affects all plugin versions up to and including 1.5. Attackers can trick authenticated administrators into submitting forged requests that modify plugin settings without consent. The issue is tracked under CWE-352: Cross-Site Request Forgery and requires user interaction to succeed. Exploitation depends on convincing a logged-in user to visit an attacker-controlled page.
Critical Impact
Successful exploitation allows unauthorized state-changing actions on the target WordPress site, resulting in limited integrity impact through unauthorized modification of plugin configuration.
Affected Products
- Alessandro Piconi Simple Keyword to Link WordPress plugin
- All versions from n/a through 1.5
- WordPress installations with the vulnerable plugin enabled
Discovery Timeline
- 2025-06-06 - CVE-2025-30980 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30980
Vulnerability Analysis
The Simple Keyword to Link plugin fails to implement anti-CSRF tokens on state-changing request handlers. WordPress provides wp_nonce_field() and check_admin_referer() primitives specifically to prevent this class of attack, but the vulnerable handlers do not validate these tokens. As a result, any authenticated session can be abused by a remote attacker who crafts a malicious HTML page. The vulnerability requires user interaction, meaning the target must click a link or load attacker-controlled content while authenticated to the WordPress admin panel.
Root Cause
The root cause is missing origin and token validation on privileged request handlers in the plugin. Requests submitted from cross-origin contexts are processed without verifying the request originated from a legitimate WordPress form. The plugin trusts the browser's session cookie as sufficient proof of intent.
Attack Vector
An attacker hosts a page containing a hidden form or JavaScript that auto-submits a request to the vulnerable plugin endpoint. When a WordPress administrator visits the page while logged in, the browser attaches session cookies to the forged request. The plugin processes the request as legitimate. The attack is network-based and requires no privileges on the target site, only user interaction from a privileged user.
No public proof-of-concept exploit is available. See the Patchstack Vulnerability Report for advisory details.
Detection Methods for CVE-2025-30980
Indicators of Compromise
- Unexpected modifications to Simple Keyword to Link plugin settings in the WordPress database wp_options table
- HTTP POST requests to plugin administration endpoints with missing or invalid Referer headers
- Administrator sessions submitting plugin configuration changes shortly after visiting external URLs
Detection Strategies
- Review web server access logs for POST requests to plugin admin endpoints originating from external Referer values
- Monitor WordPress audit logs for keyword-to-link configuration changes outside normal administrative windows
- Correlate browser history or proxy logs of privileged users with plugin configuration change timestamps
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record all option and plugin setting changes with user attribution
- Alert on modifications to plugin options performed from unusual IP addresses or user-agents
- Deploy a Web Application Firewall (WAF) rule to inspect and log cross-origin POST requests to /wp-admin/ endpoints
How to Mitigate CVE-2025-30980
Immediate Actions Required
- Deactivate the Simple Keyword to Link plugin until a patched version is confirmed available
- Audit recent plugin configuration changes and revert any unauthorized modifications
- Require administrators to log out of WordPress before browsing untrusted sites
Patch Information
No fixed version has been published at the time of this writing. The vulnerability affects Simple Keyword to Link through version 1.5. Monitor the Patchstack Vulnerability Report and the WordPress plugin repository for update announcements.
Workarounds
- Remove or deactivate the plugin from all WordPress installations where it is not essential
- Restrict WordPress administrator access with IP allow-listing at the web server or WAF layer
- Enforce SameSite=Strict or SameSite=Lax cookies for the WordPress session to reduce cross-origin submission risk
- Require administrators to use dedicated browsers or profiles for WordPress management
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate simple-keyword-to-link
wp plugin delete simple-keyword-to-link
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
