CVE-2025-30615
Published: 24 March 2025
Summary
CVE-2025-30615 is a critical-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-30615 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WP e-Commerce Style Email WordPress plugin developed by Jacob Schwartz. This flaw allows code injection and affects all versions of the plugin from its initial release through 0.6.2. The vulnerability carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges, and potential for high impacts across confidentiality, integrity, and availability with scope change.
Unauthenticated attackers (PR:N) can exploit the CSRF vulnerability remotely (AV:N) by tricking authenticated users into interacting with a malicious site (UI:R), such as clicking a forged link or loading a malicious page. Low complexity (AC:L) enables this without advanced skills. Successful exploitation allows code injection, escalating to remote code execution on the affected WordPress server, with changed scope (S:C) enabling high-impact compromise (C:H/I:H/A:H).
Patchstack provides details on the vulnerability, including analysis of the CSRF-to-remote-code-execution chain, in their advisory at https://patchstack.com/database/Wordpress/Plugin/wp-e-commerce-style-email/vulnerability/wordpress-wp-e-commerce-style-email-plugin-0-6-2-csrf-to-remote-code-execution-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7914
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Code Injection.This issue affects WP e-Commerce Style Email: from n/a through <= 0.6.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF vulnerability in a public-facing WordPress plugin directly enables remote exploitation for code injection and RCE, mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the CSRF-to-code-injection flaw in the WP e-Commerce Style Email plugin through timely patching or removal of vulnerable versions up to 0.6.2.
Enforces session authenticity to protect against CSRF attacks that trick authenticated users into submitting malicious requests leading to code injection.
Validates and sanitizes inputs to prevent code injection resulting from the exploited CSRF vulnerability in the plugin.