CVE-2025-10645

Executive Summary

CVE-2025-10645 is a Sensitive Information Exposure vulnerability in the WP Reset plugin for WordPress, affecting all versions up to and including 2.05. The flaw resides in the WF_Licensing::log() method, which, when debugging is enabled (the default setting), logs sensitive license key and site data. An unauthenticated attacker can exploit this to extract these credentials, potentially leading to unauthorized access or further compromise of the WordPress site.

This vulnerability is classified as a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). The CVSS score is 5.3 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood currently, but the risk remains due to the default debugging state.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The supply chain risk is limited to the plugin's update mechanism; users must manually update or rely on the WordPress dashboard.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – affects only the vulnerable component.
• Confidentiality: Low (C:L) – limited exposure of license keys and site data.
• Integrity: None (I:N) – no data modification.
• Availability: None (A:N) – no denial of service.

Threat Level: Medium. While the EPSS score is low, the default debugging setting and lack of authentication make this a trivial information disclosure vector.

Deep Dive & Mechanics

The vulnerability exists in the WF_Licensing::log() method within the WP Reset plugin. When debugging is enabled (which is the default configuration), this method writes sensitive data—including the license key and site URL—to a log file. The log file is accessible to unauthenticated users via a predictable path, typically /wp-content/plugins/wp-reset/logs/ or similar.

The root cause is the failure to restrict access to debug logs and the inclusion of sensitive information in log entries. The log() method is called during license validation and activation, capturing the license key in plaintext.

Attack Flow:

1. Attacker identifies a WordPress site running WP Reset <= 2.05.
2. Attacker accesses the debug log file (e.g., https://target.com/wp-content/plugins/wp-reset/logs/debug.log).
3. The log contains entries like License key: WP-LIC-XXXX-XXXX-XXXX and Site URL: https://target.com.
4. Attacker extracts the license key, potentially using it to activate the plugin on other sites or for further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.05):

class WF_Licensing {
    public static function log($message) {
        if (defined('WP_DEBUG') && WP_DEBUG) {
            $log_file = WP_CONTENT_DIR . '/plugins/wp-reset/logs/debug.log';
            file_put_contents($log_file, date('Y-m-d H:i:s') . ' - ' . $message . PHP_EOL, FILE_APPEND);
        }
    }

    public static function activate_license($key) {
        self::log('License key: ' . $key);
        // ... activation logic
    }
}

Patched Code (Hypothetical):

class WF_Licensing {
    public static function log($message) {
        // Only log if debugging is explicitly enabled and user is admin
        if (defined('WP_DEBUG') && WP_DEBUG && current_user_can('manage_options')) {
            $log_file = WP_CONTENT_DIR . '/plugins/wp-reset/logs/debug.log';
            // Sanitize sensitive data
            $safe_message = preg_replace('/License key: [^\s]+/', 'License key: [REDACTED]', $message);
            file_put_contents($log_file, date('Y-m-d H:i:s') . ' - ' . $safe_message . PHP_EOL, FILE_APPEND);
        }
    }
}

The patch should:

• Restrict logging to authenticated administrators.
• Redact sensitive data (license keys) in log entries.
• Disable debugging by default.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with WP Reset <= 2.05 installed and activated.
• Debugging enabled (default).

Exploitation Steps:

1. Identify Target: Use Shodan or Google dorks to find vulnerable sites.
2. Access Log File: Send a GET request to the debug log:

   curl -s https://target.com/wp-content/plugins/wp-reset/logs/debug.log
   

3. Extract Data: Parse the log for lines containing License key: or Site URL:.
4. Use License Key: Attempt to reuse the license key on other sites or for unauthorized activations.

Example Output:

2025-03-15 10:30:00 - License key: WP-LIC-ABCD-1234-EFGH
2025-03-15 10:30:01 - Site URL: https://target.com

Blue Team (Defense & Detection)

Immediate Actions:

1. Disable Debugging: Set define('WP_DEBUG', false); in wp-config.php.
2. Remove Log Files: Delete any existing log files in /wp-content/plugins/wp-reset/logs/.
3. Update Plugin: Check for updates; if none, manually patch or disable the plugin.

Detection:

• Monitor for access to /wp-content/plugins/wp-reset/logs/debug.log.
• Alert on log entries containing "License key".

Indicators of Compromise (IOCs)

• File Path: /wp-content/plugins/wp-reset/logs/debug.log
• Log Entry Pattern: License key: WP-LIC-*
• URL Pattern: https://target.com/wp-content/plugins/wp-reset/logs/debug.log
• Network Traffic: GET requests to the above URL from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2025_10645_WP_Reset_Log_Exposure {
    meta:
        description = "Detects WP Reset debug log file containing license keys"
        author = "Valters IT"
        date = "2025-03-15"
        reference = "CVE-2025-10645"
    strings:
        $license_key = /License key: [A-Z0-9\-]+/
        $site_url = /Site URL: https?:\/\/[^\s]+/
    condition:
        $license_key or $site_url
}

Sigma Rule

title: WP Reset Debug Log Access
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects access to WP Reset debug log file
author: Valters IT
date: 2025-03-15
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "/wp-content/plugins/wp-reset/logs/debug.log"
    condition: selection
falsepositives:
    - Legitimate admin debugging
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10645 WP Reset Debug Log Access"; flow:to_server; http.uri; content:"/wp-content/plugins/wp-reset/logs/debug.log"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Disable Debugging: Set define('WP_DEBUG', false); in wp-config.php.
2. Delete Log Files: Remove /wp-content/plugins/wp-reset/logs/debug.log.
3. Restrict Access: Add .htaccess rules to deny access to the logs directory:

   <Directory "/wp-content/plugins/wp-reset/logs">
       Require all denied
   </Directory>
   

Long-term:

1. Update Plugin: Apply vendor patch when available.
2. Monitor Logs: Implement logging and alerting for access to sensitive files.
3. Audit Plugins: Regularly review plugin security and disable unnecessary debugging.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.