What is the CVSS score of CVE-2025-54030?

CVE-2025-54030 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-54030

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-07-16 audit@patchstack.com

WordPress CSRF Google

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 11:15 nvd

N/A

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in WesternDeal WooCommerce Google Sheet Connector wc-gsheetconnector allows Cross Site Request Forgery.This issue affects WooCommerce Google Sheet Connector: from n/a through <= 1.3.20.

AnalysisAI

Cross-Site Request Forgery (CSRF) vulnerability in WesternDeal WooCommerce Google Sheet Connector plugin versions up to 1.3.20 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated WordPress administrators. The plugin fails to implement proper CSRF token validation on critical functionality, enabling attackers to craft malicious requests that execute actions without explicit user consent. Although EPSS scoring indicates low exploitation probability (0.02%), CSRF vulnerabilities targeting WordPress admin functions represent a meaningful risk in multi-admin environments where social engineering can trick administrators into visiting attacker-controlled pages.

Technical ContextAI

The WooCommerce Google Sheet Connector is a WordPress plugin (CPE: cpe:2.3:a:patchstack:wc-gsheetconnector:*:*:*:*:*:wordpress:*:*) that integrates WooCommerce stores with Google Sheets for data synchronization and reporting. The vulnerability stems from CWE-352 (Cross-Site Request Forgery / CSRF), a failure to implement anti-CSRF tokens (nonces in WordPress terminology) on state-changing operations. WordPress provides the wp_nonce_field() and wp_verify_nonce() functions specifically to mitigate CSRF attacks; the plugin's absence of proper nonce validation on administrative or AJAX endpoints allows an attacker's crafted HTML form or JavaScript request to execute privileged actions (such as modifying connector settings, triggering data syncs, or altering sheet mappings) when a logged-in administrator visits an attacker-controlled webpage.

Affected ProductsAI

WesternDeal WooCommerce Google Sheet Connector (plugin slug: wc-gsheetconnector) versions 1.3.20 and earlier are affected. The plugin is distributed via the WordPress.org plugin repository and used in WooCommerce e-commerce installations. No minimum version boundary is documented in available data, meaning all known versions up to and including 1.3.20 are in scope. Affected WordPress environments are those running WooCommerce with this plugin active and exposed to unauthenticated attackers capable of social engineering site administrators.

RemediationAI

Upgrade WooCommerce Google Sheet Connector to a patched version newer than 1.3.20 as soon as available from the WordPress.org plugin repository or the vendor's official update mechanism. Administrators should check their WordPress admin dashboard (Plugins > Updates) for an available update. If no patched version is yet released, implement immediate workarounds: (1) Restrict administrative access to trusted IP ranges via .htaccess or WAF rules; (2) enforce strong, unique passwords and multi-factor authentication (MFA) on all admin accounts to reduce impact of social engineering; (3) disable or deactivate the plugin temporarily if data synchronization is not actively needed; (4) monitor WooCommerce order and inventory logs for unauthorized changes. Review the vendor advisory at https://patchstack.com/database/Wordpress/Plugin/wc-gsheetconnector/vulnerability/wordpress-woocommerce-google-sheet-connector-plugin-1-3-20-cross-site-request-forgery-csrf-vulnerability for patched version details upon release.