CVE-2025-11835

Executive Summary

CVE-2025-11835 is a WordPress plugin vulnerability affecting the Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin (versions up to and including 2.16.4). The flaw resides in the PMS_AJAX_Checkout_Handler::process_payment() function, which lacks proper capability checks and input validation. This allows unauthenticated attackers to trigger stored auto-renew charges for arbitrary members, leading to unauthorized modification of subscription data. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch details are available.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability allows unauthenticated attackers to manipulate subscription renewal charges, potentially causing financial disruption or unauthorized billing. However, the impact is limited to integrity (modification of data) without affecting confidentiality or availability.

Deep Dive & Mechanics

The vulnerability exists in the PMS_AJAX_Checkout_Handler::process_payment() function, which handles AJAX requests for payment processing. The function fails to verify that the requesting user has the necessary capabilities (e.g., manage_options or edit_posts) and does not validate the input parameters (such as user ID or subscription ID) against the current user's session. This enables an unauthenticated attacker to send crafted AJAX requests to trigger stored auto-renew charges for any member.

Attack Flow:

1. An attacker sends a POST request to the WordPress AJAX endpoint (admin-ajax.php) with the action pms_process_checkout.
2. The request includes parameters like user_id, subscription_id, and amount.
3. The process_payment() function processes the request without checking if the attacker is authorized to modify the specified user's subscription.
4. The system triggers a stored auto-renew charge for the targeted member, potentially causing unauthorized billing.

Root Cause: Missing capability check (current_user_can()) and missing nonce validation in the AJAX handler.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.16.4):

public function process_payment() {
    // No capability check
    $user_id = intval($_POST['user_id']);
    $subscription_id = intval($_POST['subscription_id']);
    // Process payment without validation
    // ...
}

Patched Code (Hypothetical):

public function process_payment() {
    // Check if user has admin capabilities
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'pms_process_checkout')) {
        wp_die('Nonce verification failed', 403);
    }
    $user_id = intval($_POST['user_id']);
    $subscription_id = intval($_POST['subscription_id']);
    // Process payment with validation
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Paid Membership Subscriptions plugin <= 2.16.4.
• No authentication required.

Exploitation Steps:

1. Identify the AJAX endpoint: https://target.com/wp-admin/admin-ajax.php
2. Craft a POST request to trigger unauthorized auto-renew charge:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=pms_process_checkout&user_id=1&subscription_id=2&amount=29.99"

3. The server processes the request and triggers a stored auto-renew charge for user ID 1.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action pms_process_checkout from unauthenticated users.
• Look for unusual patterns in payment processing logs.

Hunting:

• Search for pms_process_checkout in web server access logs.
• Check for multiple failed payment attempts from the same IP.

Mitigation:

• Apply the vendor patch when available.
• Implement Web Application Firewall (WAF) rules to block unauthenticated AJAX requests to payment handlers.
• Restrict access to admin-ajax.php for sensitive actions.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /wp-admin/admin-ajax.php with action=pms_process_checkout from unauthenticated sources.
  • Unusual payment amounts or subscription IDs in AJAX requests.

• Host:

  • Modified subscription records in the WordPress database (wp_pms_member_subscriptions table).
  • Unexpected auto-renew charges in payment gateway logs.

• Logs:

  • Web server logs showing admin-ajax.php requests with pms_process_checkout action from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2025_11835_WordPress_Plugin {
    meta:
        description = "Detects exploitation attempts for CVE-2025-11835 in WordPress Paid Membership Subscriptions plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11835"
    strings:
        $ajax_action = "pms_process_checkout"
        $user_id_param = "user_id="
        $subscription_id_param = "subscription_id="
    condition:
        $ajax_action and ($user_id_param or $subscription_id_param)
}

Sigma Rule

title: CVE-2025-11835 - Unauthorized Payment Processing via AJAX
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects unauthenticated AJAX requests to process payments in WordPress Paid Membership Subscriptions plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=pms_process_checkout'
    condition: selection
falsepositives:
    - Legitimate admin requests (should be authenticated)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11835 - Unauthorized Payment Processing Attempt"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=pms_process_checkout"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to admin-ajax.php with action=pms_process_checkout.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the vendor patch when released (currently UNKNOWN).
• Upgrade to a patched version (check plugin repository for updates).
• Implement capability checks and nonce validation in custom code.

Workaround:

• Add a custom function to functions.php to restrict AJAX actions:

add_action('wp_ajax_pms_process_checkout', 'custom_pms_checkout_handler', 1);
function custom_pms_checkout_handler() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}

Valters IT
Securing Digital Frontiers