CVE-2025-57914: Shipos WooCommerce Plugin CSRF Vulnerability

CVE-2025-57914 Overview

CVE-2025-57914 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Matat Technologies Deliver via Shipos for WooCommerce plugin (wc-shipos-delivery). The flaw impacts all plugin versions from initial release through 3.0.2. The vulnerability is classified under CWE-352: Cross-Site Request Forgery. An attacker can trick an authenticated administrator into performing state-changing actions on the WooCommerce store by loading a crafted page or link. Exploitation requires user interaction but no authentication on the attacker's side.

Critical Impact
An attacker can leverage a victim's authenticated session to modify plugin settings or trigger unintended actions on WooCommerce shipping configurations without the user's consent.

Affected Products

Matat Technologies Deliver via Shipos for WooCommerce (wc-shipos-delivery) — all versions up to and including 3.0.2
WordPress deployments running WooCommerce with the affected plugin enabled
Administrative users of the affected plugin

Discovery Timeline

2025-09-22 - CVE-2025-57914 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57914

Vulnerability Analysis

The vulnerability stems from missing or insufficient CSRF protections in the wc-shipos-delivery plugin. State-changing endpoints in the plugin do not validate the origin of incoming requests using a WordPress nonce (wp_nonce_field / check_admin_referer). An attacker who lures an authenticated WordPress administrator to a malicious page can issue forged HTTP requests that execute privileged plugin actions in the victim's browser context.

The attack requires network access to the target site and user interaction, but no attacker-side credentials. The scope of impact is limited to integrity changes within the plugin's functional boundary, with no direct impact to confidentiality or availability.

Root Cause

The plugin does not enforce anti-CSRF token validation on sensitive request handlers. WordPress provides nonce primitives to bind requests to a specific user session and action, but the plugin either omits nonce generation on forms or fails to validate submitted nonces on the server. This allows cross-origin form submissions or image/script requests to trigger backend actions using the victim's authenticated cookies.

Attack Vector

Exploitation typically proceeds by hosting an attacker-controlled page containing an auto-submitting HTML form or a crafted img tag that targets a vulnerable plugin endpoint. When a logged-in administrator visits the page, the browser attaches WordPress session cookies to the outbound request. The server processes the request as legitimate, applying the attacker-specified changes. Because no CSRF token is validated, the forged request succeeds.

See the Patchstack CSRF Vulnerability Report for advisory-level technical details. No public proof-of-concept code has been released.

Detection Methods for CVE-2025-57914

Indicators of Compromise

Unexpected changes to wc-shipos-delivery plugin configuration in the WordPress admin database (wp_options)
WordPress access logs showing POST requests to plugin admin endpoints with cross-origin Referer headers or missing Referer
Administrator actions correlated with the user visiting external sites shortly before configuration changes

Detection Strategies

Audit WordPress request logs for state-changing requests to wc-shipos-delivery endpoints that lack a valid _wpnonce parameter
Compare current plugin settings against a known-good baseline to detect unauthorized modifications
Monitor for anomalous administrator activity patterns, such as configuration changes outside normal business hours

Monitoring Recommendations

Enable WordPress audit logging plugins to record administrative configuration changes with user and source IP attribution
Forward WordPress and web server logs to a centralized SIEM for correlation with browsing telemetry
Alert on high-value plugin configuration changes and require secondary review

How to Mitigate CVE-2025-57914

Immediate Actions Required

Identify all WordPress instances running Deliver via Shipos for WooCommerce at version 3.0.2 or earlier
Restrict WordPress administrator accounts to dedicated browsers or sessions that do not browse untrusted content
Enforce least privilege — reduce the number of accounts with plugin management capabilities
Review recent plugin configuration changes for signs of unauthorized modification

Patch Information

At the time of the NVD publication, no fixed version had been indicated in the enriched data. Administrators should consult the vendor and the Patchstack CSRF Vulnerability Report for the latest remediation guidance and upgrade path beyond 3.0.2.

Workarounds

Disable the wc-shipos-delivery plugin until a patched version is confirmed available
Deploy a Web Application Firewall (WAF) rule to block state-changing requests to plugin endpoints that lack a valid _wpnonce parameter or that carry a cross-origin Referer
Configure the WordPress session cookie with SameSite=Lax or SameSite=Strict to reduce cross-site cookie attachment
Train administrators to log out of WordPress when not actively managing the site

bash

# Example nginx rule to block cross-origin POSTs to the plugin admin endpoint
location ~* /wp-admin/admin\.php {
    if ($request_method = POST) {
        set $block 0;
        if ($http_referer !~* "^https?://your-site\.example/") { set $block 1; }
        if ($arg_page ~* "wc-shipos-delivery") { set $block "${block}1"; }
        if ($block = 11) { return 403; }
    }
}