CVE-2025-30912 in Float Menu Plugin
Summary
by MITRE • 03/27/2025
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Float menu allows Cross Site Request Forgery. This issue affects Float menu: from n/a through 6.1.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 03/27/2025
The CVE-2025-30912 vulnerability represents a critical Cross-Site Request Forgery flaw within the Wow-Company Float menu plugin, a widely used WordPress navigation component that enables users to create floating menus for their websites. This vulnerability stems from insufficient validation of HTTP request origins and lack of proper anti-CSRF token implementation within the plugin's administrative interfaces. The affected version range spans from the initial release through version 6.1.2, indicating a long-standing security gap that has persisted across multiple iterations of the plugin's development lifecycle. The vulnerability is particularly concerning as it affects the core functionality of WordPress admin panels where legitimate users perform critical operations such as menu modifications, content updates, and configuration changes.
The technical implementation of this CSRF vulnerability occurs when an authenticated administrator visits a malicious website or clicks on a crafted link that triggers unauthorized actions within the Float menu plugin's administrative interface. The flaw exists because the plugin fails to validate that requests originate from legitimate sources within the same domain, instead relying on cookie-based authentication alone. This allows attackers to craft malicious requests that appear to come from authenticated users, exploiting the trust relationship between the browser and the WordPress admin interface. The vulnerability can be exploited through various vectors including social engineering campaigns, compromised websites, or by leveraging existing access to a victim's browser session. The absence of proper CSRF tokens or origin validation mechanisms means that any HTTP request sent to the plugin's endpoints can potentially be executed without the user's explicit consent.
The operational impact of this vulnerability extends beyond simple data manipulation to encompass potential complete compromise of WordPress installations that utilize the affected Float menu plugin. An attacker could leverage this vulnerability to modify menu structures, inject malicious code into navigation elements, or potentially escalate privileges within the WordPress environment. The vulnerability affects the integrity and availability of website navigation systems, which could result in users being redirected to malicious sites or experiencing degraded user experience due to compromised menu configurations. In high-traffic websites, this could lead to significant reputational damage and potential data exfiltration if the attacker can manipulate the menu to redirect users to phishing pages or malicious content. The vulnerability also presents a risk to website owners who may not immediately detect unauthorized modifications to their navigation structures.
Mitigation strategies for CVE-2025-30912 should prioritize immediate plugin updates to versions that address the CSRF implementation gaps, as recommended by the vendor and security advisories. Organizations should implement additional security measures including the deployment of Content Security Policy headers to restrict the sources from which scripts can be loaded, and the implementation of proper CSRF token validation mechanisms within their web applications. Network administrators should monitor for suspicious activities related to menu modifications and implement automated alerting systems for unauthorized changes to navigation structures. The vulnerability aligns with CWE-352, which specifically addresses Cross-Site Request Forgery weaknesses, and can be mapped to ATT&CK technique T1059.001 for command and scripting interpreter usage, as attackers may leverage compromised menu structures to execute malicious commands. Additionally, implementing proper input validation and output encoding practices would help prevent exploitation of similar vulnerabilities in the broader WordPress ecosystem, as outlined in the OWASP Top Ten security principles.