CVE-2025-54038: MotoPress Restaurant Menu CSRF Vulnerability

CVE-2025-54038 Overview

CVE-2025-54038 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Restaurant Menu by MotoPress WordPress plugin (mp-restaurant-menu). The flaw impacts all versions up to and including 2.4.6. An attacker can trick an authenticated user into submitting a forged request to the vulnerable plugin, resulting in limited integrity and availability impact. Exploitation requires user interaction, typically through a malicious link or crafted web page. The vulnerability is categorized under CWE-352: Cross-Site Request Forgery.

Critical Impact
Attackers can perform unauthorized state-changing actions on behalf of an authenticated WordPress user, potentially modifying restaurant menu data or plugin configuration when the victim visits an attacker-controlled page.

Affected Products

Restaurant Menu by MotoPress (mp-restaurant-menu) WordPress plugin
All versions from n/a through 2.4.6
WordPress sites with the plugin installed and active

Discovery Timeline

2025-07-16 - CVE-2025-54038 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54038

Vulnerability Analysis

The vulnerability stems from the plugin's failure to validate the origin of state-changing HTTP requests. WordPress provides a nonce mechanism to defend against CSRF, but the affected handlers in mp-restaurant-menu do not properly verify these tokens. An attacker crafts a malicious page containing a form or script that targets the plugin endpoint. When an authenticated administrator or privileged user visits this page, the browser automatically sends session cookies with the forged request. The plugin then processes the request as if it came from a legitimate user action.

The attack requires user interaction, which reduces exploitability compared to purely automated attacks. However, targeted phishing against site administrators makes this a practical attack path against WordPress restaurant sites.

Root Cause

The root cause is missing or insufficient CSRF token validation on plugin action handlers. The plugin does not enforce wp_verify_nonce() or an equivalent check before executing privileged operations. This design flaw maps directly to CWE-352.

Attack Vector

Exploitation follows a standard CSRF pattern. The attacker hosts a page containing an auto-submitting HTML form or JavaScript fetch call targeting the vulnerable plugin endpoint on a WordPress site. The attacker then delivers the link via email, social media, or a compromised site. When a logged-in WordPress user with sufficient privileges loads the page, the browser attaches authentication cookies and the plugin executes the attacker-supplied action. Because no verified proof-of-concept code is publicly available for this issue, refer to the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-54038

Indicators of Compromise

Unexpected modifications to restaurant menu items, categories, or plugin settings in WordPress admin logs
HTTP POST requests to mp-restaurant-menu endpoints with Referer headers pointing to external, untrusted domains
Administrator sessions showing state changes shortly after visiting external links or opening email attachments

Detection Strategies

Inspect web server access logs for requests to plugin action endpoints that lack expected nonce parameters or carry suspicious Referer values
Enable WordPress audit logging plugins to record content and configuration changes with user, timestamp, and origin metadata
Correlate authenticated administrator browsing activity with subsequent privileged actions on the WordPress site

Monitoring Recommendations

Alert on cross-origin POST requests targeting /wp-admin/admin-ajax.php or plugin routes associated with mp-restaurant-menu
Monitor for outbound clicks by administrator accounts to newly registered or low-reputation domains
Track version metadata for the mp-restaurant-menu plugin across managed WordPress deployments to identify unpatched installations

How to Mitigate CVE-2025-54038

Immediate Actions Required

Identify all WordPress installations running Restaurant Menu by MotoPress version 2.4.6 or earlier and prioritize them for update
Restrict administrator accounts from browsing untrusted sites in the same browser session used to manage WordPress
Enforce least privilege by removing unnecessary administrator or editor roles from user accounts

Patch Information

At the time of publication, the vulnerability affects Restaurant Menu by MotoPress through version 2.4.6. Site operators should consult the Patchstack Vulnerability Report and the MotoPress vendor page for the latest fixed release, and apply the update as soon as it is available.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks cross-origin POST requests to mp-restaurant-menu endpoints lacking a valid Referer from the site's own domain
Deactivate the Restaurant Menu by MotoPress plugin until a patched version is installed if the functionality is not business-critical
Require administrators to use a dedicated browser or browser profile for WordPress management to reduce cross-site request exposure

bash

# Example ModSecurity rule to block cross-origin POSTs to the plugin
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1005401,phase:2,deny,status:403,log,msg:'CVE-2025-54038 CSRF mitigation'"
  SecRule REQUEST_URI "@contains mp-restaurant-menu" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example" "t:none"