CVE-2025-47517: Accept Donations with PayPal CSRF Flaw

CVE-2025-47517 Overview

CVE-2025-47517 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Scott Paterson Accept Donations with PayPal & Stripe WordPress plugin (easy-paypal-donation). The flaw affects all versions up to and including 1.4.5. Successful exploitation chains CSRF with Stored Cross-Site Scripting (XSS), allowing attackers to inject persistent JavaScript into the WordPress admin context when an authenticated administrator visits an attacker-controlled page.

Critical Impact
An attacker can trick an authenticated administrator into submitting a forged request that stores malicious JavaScript in the plugin's configuration, executing in the browser of any user who loads the affected page.

Affected Products

WordPress plugin: Accept Donations with PayPal & Stripe (easy-paypal-donation)
Vendor: Scott Paterson (wpplugin)
Versions: n/a through <= 1.4.5

Discovery Timeline

2025-05-07 - CVE-2025-47517 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47517

Vulnerability Analysis

The vulnerability combines two weaknesses in the easy-paypal-donation plugin. First, plugin endpoints handling administrative settings do not validate anti-CSRF tokens (WordPress nonces) on state-changing requests. Second, values submitted to those endpoints are stored and later rendered without sufficient output encoding, resulting in Stored XSS.

An attacker hosts a malicious page containing a forged form or JavaScript that automatically submits a request to the vulnerable admin endpoint. When a logged-in WordPress administrator visits the attacker's page, the browser sends the request along with valid session cookies. The plugin accepts the request and persists attacker-controlled input containing JavaScript payloads.

Once stored, the payload executes whenever an administrator or site visitor loads the affected page. This enables session theft, administrator account takeover, creation of rogue admin users, and injection of SEO spam or malicious redirects.

Root Cause

The root cause is missing CSRF protection [CWE-352] on plugin request handlers, compounded by absent input sanitization and output escaping. WordPress provides wp_nonce_field(), check_admin_referer(), and sanitization helpers such as sanitize_text_field() and wp_kses(), none of which are applied to the vulnerable code paths in versions <= 1.4.5.

Attack Vector

Exploitation requires network access and administrator user interaction, specifically clicking a link or loading an attacker-controlled page while authenticated to WordPress. The scope is changed because the injected script executes in the browser of any user viewing the affected page, extending impact beyond the initially targeted administrator.

Attack chain (conceptual):
1. Attacker crafts a page that auto-submits a POST request to the vulnerable plugin endpoint.
2. The request body contains a payload such as <script>...</script> in a settings field.
3. Authenticated admin visits the page; browser forwards session cookies.
4. Plugin stores the payload without nonce validation or sanitization.
5. Payload executes on subsequent page loads in the admin or front-end context.

Detection Methods for CVE-2025-47517

Indicators of Compromise

Unexpected <script>, onerror, or onload attributes in plugin settings stored in the wp_options table.
New or modified WordPress administrator accounts created shortly after an admin session.
Outbound requests from admin browsers to unfamiliar domains referenced by the plugin's rendered pages.
Modifications to plugin configuration timestamps without corresponding admin activity in audit logs.

Detection Strategies

Review the wp_options table for plugin-specific keys containing HTML or JavaScript syntax.
Inspect web server access logs for POST requests to plugin endpoints lacking a _wpnonce parameter or referer from wp-admin.
Use WordPress security scanners (e.g., WPScan, Patchstack) to identify vulnerable plugin versions across the estate.
Correlate admin login events with subsequent settings changes to detect forged requests originating from external referers.

Monitoring Recommendations

Alert on modifications to plugin option rows containing angle brackets, javascript: URIs, or event handler attributes.
Monitor for unauthorized admin user creation and role changes within the WordPress database.
Enable file integrity monitoring on the plugin directory to detect tampering.

How to Mitigate CVE-2025-47517

Immediate Actions Required

Deactivate the Accept Donations with PayPal & Stripe plugin on any site running version 1.4.5 or earlier until a fixed release is confirmed and installed.
Rotate WordPress administrator passwords and invalidate active sessions after removing any injected payloads.
Audit wp_options and plugin settings for stored JavaScript, and remove malicious content.

Patch Information

No fixed version is identified in the enriched data. Consult the Patchstack Vulnerability Report for the latest vendor remediation status and upgrade guidance.

Workarounds

Restrict access to /wp-admin/ by IP allowlist via web server configuration or a Web Application Firewall (WAF).
Deploy a WAF rule to block cross-origin POST requests to plugin endpoints without a valid WordPress nonce.
Require administrators to authenticate in a dedicated browser profile and log out immediately after making changes.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts on /wp-admin/ pages.

bash

# Example nginx rule: block POST to plugin endpoint without same-origin referer
location ~ ^/wp-admin/admin\.php$ {
    if ($request_method = POST) {
        if ($http_referer !~* "^https?://your-site\.com/") {
            return 403;
        }
    }
}