CVE-2025-30542

Vulnerability

The SoundCloud Ultimate plugin for WordPress (versions up to and including 1.5) contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions without their consent. The plugin is no longer available on WordPress.org as of March 11, 2025, due to a security issue [1].

Exploitation

An attacker can exploit this CSRF vulnerability by crafting a malicious link or form that, when clicked or submitted by an authenticated WordPress administrator, triggers an unauthorized action on the vulnerable site. No authentication is required for the attacker, but the victim must have an active session with the site.

Impact

Successful exploitation could allow an attacker to perform any action that the victim administrator is authorized to do, such as modifying plugin settings, creating new admin accounts, or injecting malicious content. The exact scope depends on the specific actions exposed by the plugin without CSRF protection.

Mitigation

No patched version is available because the plugin has been removed from the WordPress plugin directory due to a security issue [1]. Users who have the plugin installed should immediately uninstall it and consider alternative solutions. There is no known workaround.