Cyber Posture

CVE-2025-30783

High

Published: 27 March 2025

Published
27 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L
EPSS Score 0.0009 25.8th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-30783 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WP Google Review Slider plugin (wp-google-places-review-slider) for WordPress, developed by jgwhite33. The flaw enables SQL Injection and affects all versions from n/a through 16.0 inclusive. It received a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, changed scope, high confidentiality impact, and low availability impact.

An attacker can exploit this vulnerability remotely without authentication by tricking a legitimate user—likely an authenticated WordPress administrator or editor—into performing a malicious action, such as visiting a crafted webpage or clicking a link. This triggers the CSRF-protected endpoint lacking proper token validation, leading to SQL Injection execution. Successful exploitation allows the attacker to extract sensitive data from the database, achieving high confidentiality impact, while causing limited availability disruption.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-google-places-review-slider/vulnerability/wordpress-wp-google-review-slider-plugin-16-0-csrf-to-sql-injection-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-352

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

CSRF vulnerability in public-facing WordPress plugin directly enables remote exploitation of the application via SQL Injection for database data extraction.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References