CVE-2025-11448

Executive Summary

CVE-2025-11448 is a Missing Authorization vulnerability in the Envira Photo Gallery WordPress plugin (versions up to and including 1.11.0). The flaw resides in the /envira-convert/v1/bulk-convert REST API endpoint, which lacks a proper capability check. This allows authenticated attackers with Contributor-level access or higher to convert existing galleries into Envira galleries without authorization. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept (PoC) or exploit code has been released.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin's update channel for a patched version. Since no patch is currently available, site administrators should restrict access to the vulnerable REST endpoint or disable the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs Contributor-level account.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Unauthorized modification of gallery data.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. Exploitation requires authentication but low privileges. Impact is limited to unauthorized data modification.

Deep Dive & Mechanics

The vulnerability exists in the REST API endpoint /envira-convert/v1/bulk-convert. This endpoint is intended to allow administrators to convert existing galleries (e.g., from other plugins) into Envira Photo Gallery format. However, the code does not enforce a capability check (e.g., manage_options or edit_posts) before processing the request. As a result, any authenticated user with Contributor role (who can typically only write posts) can trigger the conversion process.

The endpoint likely iterates over a list of gallery IDs provided in the request body and performs the conversion. Without proper authorization, an attacker could:

• Convert all existing galleries to Envira format, potentially breaking their display or functionality.
• Overwrite existing Envira galleries with converted data from other sources.
• Cause denial of service by converting large numbers of galleries.

The vulnerability is classified under CWE-862: Missing Authorization.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.11.0):

// No capability check before processing
register_rest_route('envira-convert/v1', '/bulk-convert', array(
    'methods' => 'POST',
    'callback' => 'envira_bulk_convert_callback',
    'permission_callback' => '__return_true' // Missing capability check
));

Patched Code (Hypothetical):

// Proper capability check added
register_rest_route('envira-convert/v1', '/bulk-convert', array(
    'methods' => 'POST',
    'callback' => 'envira_bulk_convert_callback',
    'permission_callback' => function() {
        return current_user_can('manage_options'); // Only admins can convert
    }
));

Exploitation & Lab Setup

Red Team

Since no public exploit code exists, a manual exploitation approach is described:

1. Prerequisites: Obtain a valid WordPress account with Contributor role or higher.
2. Identify Target: Locate a WordPress site running Envira Photo Gallery <= 1.11.0.
3. Craft Request: Send a POST request to /wp-json/envira-convert/v1/bulk-convert with a JSON body containing gallery IDs to convert.
4. Execute:

   curl -X POST https://target.com/wp-json/envira-convert/v1/bulk-convert \
     -H "Content-Type: application/json" \
     -H "Cookie: wordpress_logged_in_<hash>=<session>" \
     -d '{"gallery_ids": [1, 2, 3]}'
   

5. Verify: Check if galleries have been converted to Envira format.

Blue Team

• Monitor REST API Logs: Look for unusual POST requests to /envira-convert/v1/bulk-convert from non-admin users.
• Audit User Roles: Review all Contributor-level accounts for suspicious activity.
• Network Detection: Deploy Suricata rules (see Detection Engineering) to alert on exploitation attempts.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-json/envira-convert/v1/bulk-convert with JSON body containing gallery_ids.
• Logs: WordPress audit logs showing gallery conversion events by non-admin users.
• File: Modified gallery data in the WordPress database (post type envira or envira_gallery).

Detection Engineering

YARA Rule

rule CVE_2025_11448_Envira_Gallery_Missing_Auth {
    meta:
        description = "Detects exploitation attempts of CVE-2025-11448 in Envira Photo Gallery"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11448"
    strings:
        $endpoint = "/envira-convert/v1/bulk-convert"
        $json_key = "gallery_ids"
    condition:
        $endpoint and $json_key
}

Sigma Rule

title: CVE-2025-11448 Envira Gallery Missing Authorization Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to the vulnerable Envira Gallery REST API endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/envira-convert/v1/bulk-convert"
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-11448 Envira Gallery Missing Authorization Exploitation";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/envira-convert/v1/bulk-convert";
    http_uri;
    content:"gallery_ids";
    http_client_body;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-11448;
)

Remediation & Mitigation

1. Immediate: Disable the Envira Photo Gallery plugin until a patch is released.
2. Workaround: Add a custom capability check via a WordPress filter or modify the plugin code to require manage_options capability.
3. Long-term: Apply the official patch once available from the vendor.
4. Monitoring: Implement the detection rules above to identify exploitation attempts.
5. User Management: Restrict Contributor-level accounts and audit their activities.

Valters IT
Securing Digital Frontiers