CVE-2025-57930: Double the Donation CSRF Vulnerability

CVE-2025-57930 Overview

CVE-2025-57930 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Double the Donation WordPress plugin developed by kanwei_doublethedonation. The flaw impacts all plugin versions up to and including 2.0.0. An attacker can craft a malicious request that, when triggered by an authenticated user visiting an attacker-controlled page, performs unauthorized state-changing actions within the plugin. The vulnerability is classified under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction but no privileges from the attacker.

Critical Impact
Attackers can trick authenticated WordPress users into executing unauthorized actions in the Double the Donation plugin, resulting in limited integrity impact on plugin configuration or data.

Affected Products

Double the Donation WordPress plugin (double-the-donation) versions up to and including 2.0.0
WordPress sites with the plugin installed and active
Any authenticated administrator or privileged user session on the affected site

Discovery Timeline

2025-09-22 - CVE-2025-57930 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57930

Vulnerability Analysis

The Double the Donation plugin fails to properly validate the origin of state-changing HTTP requests. WordPress provides a nonce mechanism specifically to prevent CSRF attacks, but the affected plugin endpoints do not enforce nonce validation on all sensitive actions. As a result, an attacker can construct an HTML form or JavaScript payload on an external site that submits a request to the target WordPress instance. If a logged-in user with sufficient privileges visits the malicious page, the browser automatically attaches the session cookie, and the request is processed as legitimate.

The scope is limited to integrity impact. The vulnerability does not directly expose confidential data or degrade availability. However, unauthorized modification of donation-related configuration could affect campaign integrity or downstream nonprofit workflows.

Root Cause

The root cause is missing or improperly implemented anti-CSRF tokens on plugin action handlers. WordPress plugins are expected to call wp_verify_nonce() or check_admin_referer() before executing privileged operations. The affected version does not consistently apply these checks, allowing cross-origin requests to succeed when accompanied by a valid session cookie.

Attack Vector

An attacker hosts a malicious webpage containing a hidden form or asynchronous request targeting a vulnerable plugin endpoint on the victim's WordPress site. The attacker then lures a logged-in administrator via phishing email, social engineering, or a compromised third-party site. When the victim's browser loads the attacker page, it submits the forged request. The WordPress server processes the request under the victim's authenticated session and executes the plugin action without validating request origin. Refer to the Patchstack Vulnerability Report for additional advisory context.

Detection Methods for CVE-2025-57930

Indicators of Compromise

HTTP POST requests to Double the Donation plugin endpoints with Referer headers pointing to external or unexpected domains
Unexpected changes to plugin configuration, campaign settings, or donation form parameters in the WordPress admin database
Web server access logs showing plugin action requests without a preceding admin panel navigation from the same session

Detection Strategies

Review WordPress audit logs for administrative actions performed immediately after users visited external URLs
Inspect requests to plugin AJAX handlers and admin-post endpoints for missing or invalid _wpnonce parameters
Correlate browser history or proxy logs with plugin state changes to identify suspicious request chains

Monitoring Recommendations

Enable a WordPress security or audit-logging plugin to record all administrative changes with source IP and referrer
Monitor web application firewall (WAF) logs for cross-origin POST requests targeting /wp-admin/admin-ajax.php and plugin-specific handlers
Alert on plugin configuration modifications occurring outside expected administrator workflows or business hours

How to Mitigate CVE-2025-57930

Immediate Actions Required

Update the Double the Donation plugin to a version later than 2.0.0 once the vendor releases a patched release
Restrict WordPress administrator sessions to trusted networks and enforce short session lifetimes
Instruct privileged users to log out of WordPress before browsing unrelated sites and to avoid clicking untrusted links while authenticated

Patch Information

At the time of publication, the vulnerability affects Double the Donation versions up to and including 2.0.0. Consult the Patchstack advisory for the latest patched version information and vendor guidance.

Workarounds

Deactivate the Double the Donation plugin until a fixed version is available if it is not business-critical
Deploy a WAF rule to block cross-origin POST requests to WordPress admin endpoints that lack a valid _wpnonce parameter
Enforce SameSite=Strict or SameSite=Lax cookie attributes on WordPress authentication cookies to reduce cross-site request risk

bash

# Example WAF rule concept: block admin-ajax requests with external Referer
# ModSecurity pseudo-rule
SecRule REQUEST_URI "@beginsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,msg:'Cross-origin request to WP admin'"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-wordpress-site.example" \
  "t:none"