CVE-2025-31410: WP Church Donation CSRF Vulnerability

CVE-2025-31410 Overview

CVE-2025-31410 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Ashish Ajani WP Church Donation WordPress plugin (wp-church-donation). The flaw impacts all versions up to and including 1.7. An attacker can trick an authenticated user into submitting a forged request that performs unintended state-changing actions within the plugin. The vulnerability is classified under CWE-352 and requires user interaction to succeed. Exploitation typically occurs when a logged-in site administrator visits a malicious page while authenticated to the WordPress instance.

Critical Impact
Successful exploitation allows attackers to perform unauthorized state-changing actions within the WP Church Donation plugin by leveraging an authenticated user's session.

Affected Products

Ashish Ajani WP Church Donation plugin for WordPress
All versions from n/a through <= 1.7
WordPress sites with the wp-church-donation plugin installed and activated

Discovery Timeline

2025-03-31 - CVE-2025-31410 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31410

Vulnerability Analysis

The WP Church Donation plugin fails to properly validate the origin of state-changing HTTP requests. The plugin does not enforce anti-CSRF tokens (WordPress nonces) on sensitive actions. As a result, an attacker can craft a malicious web page or email that triggers a forged request against a target WordPress site. When an authenticated user, typically an administrator, loads the malicious content, the browser automatically submits authenticated cookies with the request.

The attack requires user interaction, meaning the target must click a link or load a page controlled by the attacker. The impact is limited to integrity, with no direct confidentiality or availability consequences reported. However, integrity changes to donation configurations or plugin settings can affect downstream operations of the affected site.

Root Cause

The root cause is missing or improperly implemented CSRF protection on plugin request handlers. WordPress provides the wp_nonce_field() and check_admin_referer() functions to prevent this class of attack. The wp-church-donation plugin through version 1.7 does not consistently apply these controls on sensitive endpoints, allowing forged cross-origin requests to succeed when accompanied by valid session cookies.

Attack Vector

The attack vector is network-based and requires no privileges on the target system. The attacker hosts a page that issues a POST or GET request to a vulnerable plugin endpoint. When an authenticated WordPress administrator visits the page, the browser attaches session cookies and the request is processed as legitimate. The specific affected endpoints and parameter details are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-31410

Indicators of Compromise

Unexpected modifications to WP Church Donation plugin settings or donation records without a corresponding administrator action in the audit trail
HTTP referrer headers pointing to external, untrusted domains on requests targeting wp-church-donation endpoints
POST requests to plugin handlers lacking a valid _wpnonce parameter

Detection Strategies

Review WordPress access logs for requests to wp-church-donation endpoints where the Referer header is missing or points to an external domain
Monitor administrator sessions for state changes that were not initiated through the standard WordPress admin interface
Deploy a web application firewall rule that inspects POST requests to the plugin's action handlers for the presence of a valid nonce token

Monitoring Recommendations

Enable WordPress activity logging plugins to track configuration and content changes made under administrator sessions
Correlate administrator browser activity with plugin state changes to identify anomalous cross-origin submissions
Alert on requests to the plugin from user agents or IP addresses that do not match established administrator patterns

How to Mitigate CVE-2025-31410

Immediate Actions Required

Deactivate the WP Church Donation plugin until a patched version is released and installed
Restrict WordPress administrator access to trusted networks and require session isolation from general web browsing
Audit recent donation records and plugin settings for unauthorized modifications

Patch Information

At the time of the last NVD update, the advisory lists affected versions up to and including 1.7 with no fixed version specified in the enriched data. Site owners should consult the Patchstack Vulnerability Report for the current patch status and upgrade guidance.

Workarounds

Disable and remove the wp-church-donation plugin from all WordPress installations until a fix is confirmed
Enforce strict SameSite=Strict or SameSite=Lax cookie attributes on the WordPress session cookie to reduce cross-origin request risk
Deploy a web application firewall with CSRF protection rules that require a valid WordPress nonce on state-changing plugin requests
Require administrators to use a dedicated browser profile for WordPress management to reduce exposure to malicious pages

bash

# Configuration example: deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate wp-church-donation
wp plugin delete wp-church-donation