CVE-2025-30981 Overview
CVE-2025-30981 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the WP-Recall plugin for WordPress, developed by tggfref. The flaw affects all versions up to and including 16.26.14. An attacker can leverage this weakness to trigger privilege escalation actions on behalf of an authenticated victim who visits a malicious page. Exploitation requires user interaction but no attacker-side authentication. The vulnerability results from missing or improperly validated CSRF tokens on privileged plugin endpoints.
Critical Impact
Successful exploitation allows an unauthenticated remote attacker to escalate privileges on a WordPress site by tricking a logged-in user into visiting a crafted page.
Affected Products
- WP-Recall WordPress plugin versions through 16.26.14
- WordPress sites with WP-Recall installed and active
- Any environment where administrators or privileged users interact with untrusted web content
Discovery Timeline
- 2025-06-06 - CVE-2025-30981 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-30981
Vulnerability Analysis
The vulnerability is a Cross-Site Request Forgery weakness in WP-Recall, a WordPress community and user profile plugin. Privileged actions exposed by the plugin do not adequately verify the origin or intent of incoming state-changing requests. An attacker crafts a malicious page or link that submits a forged request to the target WordPress site. When an authenticated user with sufficient privileges loads the attacker-controlled content, the browser automatically attaches session cookies and executes the request. The result is a change to user roles or permissions that the victim never authorized.
Because the attack pivots through the victim's active session, the underlying access control checks pass, but the intent check does not exist. This produces a privilege escalation outcome without requiring the attacker to know or steal credentials.
Root Cause
The root cause is missing or insufficient anti-CSRF protection on sensitive plugin endpoints. WordPress provides a nonce mechanism through wp_nonce_field() and check_admin_referer(), but the vulnerable code paths in WP-Recall through 16.26.14 do not enforce these checks correctly on actions that modify user privileges.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a malicious page containing an auto-submitting form or crafted image tag pointing to a WP-Recall administrative action. When a signed-in WordPress user visits the page, the browser submits the request with valid session cookies. The plugin processes the request as legitimate and performs the privileged action.
No verified public proof-of-concept is available. See the Patchstack Vulnerability Advisory for additional technical context.
Detection Methods for CVE-2025-30981
Indicators of Compromise
- Unexpected changes to WordPress user roles or capabilities, especially accounts unexpectedly promoted to administrator or editor.
- HTTP POST requests to WP-Recall endpoints originating from external Referer headers or with missing referer information.
- New or modified users created shortly after a privileged user browsed external sites or clicked untrusted links.
Detection Strategies
- Audit the WordPress wp_users and wp_usermeta tables for role changes and correlate timestamps with web server access logs.
- Review WP-Recall action requests in access logs for suspicious Referer values that do not match the site's own domain.
- Enable a WordPress activity log plugin to record user role modifications, capability changes, and plugin actions.
Monitoring Recommendations
- Alert on any change to accounts with the administrator capability outside of approved change windows.
- Monitor for POST requests to wp-admin/admin-ajax.php and WP-Recall action handlers that lack a valid same-origin Referer.
- Baseline normal privileged action patterns and flag deviations for review.
How to Mitigate CVE-2025-30981
Immediate Actions Required
- Update WP-Recall to a version later than 16.26.14 once the vendor publishes a fixed release.
- Review all WordPress user accounts and revoke unauthorized role or capability changes.
- Instruct administrators to log out of WordPress before browsing untrusted sites and to use a dedicated browser profile for administrative work.
Patch Information
At the time of publication, the advisory identifies all WP-Recall versions through 16.26.14 as affected. Consult the Patchstack Vulnerability Advisory for the current fixed version and vendor guidance.
Workarounds
- Deactivate the WP-Recall plugin until a patched version is installed if the plugin is not business-critical.
- Deploy a Web Application Firewall rule that requires a same-origin Referer or Origin header on WP-Recall action endpoints.
- Restrict administrative access to WordPress by IP allowlist to reduce the attack surface for CSRF against privileged accounts.
- Enforce short session lifetimes and require re-authentication for sensitive actions where possible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
