CVE-2025-54702: Ebook Store CSRF Vulnerability

CVE-2025-54702 Overview

CVE-2025-54702 is a Cross-Site Request Forgery (CSRF) vulnerability in the motov.net Ebook Store WordPress plugin. The flaw affects all versions up to and including 5.8013. The plugin fails to validate the origin of state-changing HTTP requests, allowing an attacker to trick an authenticated user into performing unintended actions.

The vulnerability is tracked under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction, typically clicking a crafted link or visiting an attacker-controlled page while authenticated to the target WordPress site.

Critical Impact
An attacker can perform unauthorized actions on the Ebook Store plugin on behalf of an authenticated WordPress user, resulting in limited integrity impact.

Affected Products

motov.net Ebook Store WordPress plugin (ebook-store)
All versions from initial release through 5.8013
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2025-08-14 - CVE-2025-54702 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54702

Vulnerability Analysis

The Ebook Store plugin exposes one or more state-changing endpoints that process requests without verifying a valid anti-CSRF token. WordPress provides the wp_nonce_field() and check_admin_referer() primitives specifically to prevent this class of issue, but the affected handlers do not enforce nonce validation on incoming requests.

An attacker hosts a malicious page containing a forged form or JavaScript payload targeting a vulnerable plugin endpoint. When an authenticated WordPress user visits the page, the browser automatically attaches the user's session cookies to the outbound request. The plugin then processes the request as if it were legitimate.

The attack results in limited integrity impact with no direct data confidentiality or availability loss. Impact scope is constrained to actions the victim user is authorized to perform within the plugin.

Root Cause

The root cause is missing anti-CSRF token validation on state-changing operations. The plugin relies on cookie-based session authentication alone, which browsers submit automatically with cross-origin requests. Without a synchronizer token pattern or SameSite cookie enforcement, the server cannot distinguish user-initiated actions from forged ones.

Attack Vector

Exploitation requires network access and user interaction. The attacker must convince a logged-in WordPress user, typically an administrator or privileged role, to visit a malicious page. The forged request executes silently, and the victim generally sees no indication of the action.

The vulnerability is exploitable through phishing emails, malicious advertisements, or compromised third-party sites embedding the payload. No authentication is required from the attacker directly, since the attack rides on the victim's active session.

See the Patchstack advisory for additional technical context.

Detection Methods for CVE-2025-54702

Indicators of Compromise

Unexpected POST or GET requests to Ebook Store plugin endpoints originating with Referer headers pointing to external domains.
Plugin configuration or content changes that do not correlate with legitimate administrator activity in WordPress audit logs.
Multiple identical state-changing requests to ebook-store endpoints within short time windows across different users.

Detection Strategies

Inspect web server access logs for requests to Ebook Store plugin admin endpoints lacking a same-origin Referer or Origin header.
Correlate WordPress user activity logs against expected administrator behavior patterns using a security plugin or SIEM.
Deploy a Web Application Firewall (WAF) rule that flags state-changing requests to the plugin missing valid nonce parameters.

Monitoring Recommendations

Enable verbose logging on WordPress admin actions and ingest logs into a centralized SIEM for correlation.
Monitor the wp-admin and admin-ajax.php request patterns for anomalies tied to the ebook-store action parameter.
Alert on privileged WordPress users visiting external links immediately preceding administrative state changes.

How to Mitigate CVE-2025-54702

Immediate Actions Required

Deactivate the Ebook Store plugin until a patched version above 5.8013 is confirmed available from the vendor.
Restrict WordPress administrative access to trusted networks using IP allowlisting at the web server or WAF layer.
Instruct administrators to log out of WordPress sessions before browsing untrusted sites.

Patch Information

At the time of publication, the vendor advisory tracked by Patchstack covers all versions up to and including 5.8013. Administrators should monitor the plugin repository for a fixed release that implements wp_verify_nonce() on affected endpoints.

Workarounds

Configure a WAF rule to block requests to ebook-store endpoints lacking a same-origin Referer or Origin header.
Set session cookies with SameSite=Lax or SameSite=Strict attributes to reduce cross-origin request forgery exposure.
Enforce reauthentication for privileged actions by shortening WordPress session lifetimes.

bash

# Example nginx rule blocking cross-origin POSTs to the plugin
location ~* /wp-admin/admin\.php {
    if ($http_origin !~* ^https?://(www\.)?yourdomain\.com$) {
        return 403;
    }
}