CVE-2025-12842

Executive Summary

CVE-2025-12842 is a Missing Authorization vulnerability in the Booking Plugin for WordPress Appointments – Time Slot plugin for WordPress, affecting versions up to and including 1.4.7. The vulnerability resides in the tslot_appt_email AJAX action, which lacks proper capability checks or nonce validation. This allows an unauthenticated attacker to trigger the sending of appointment notification emails to arbitrary recipients. The attacker can control the text content within certain email fields, enabling the plugin to be abused as an open email relay for phishing campaigns or spam distribution. This is a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx).

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Users should verify the integrity of their plugin files by comparing checksums against the WordPress repository. No known supply chain compromise has been reported for this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The attacker does not need to trick a user.
• Scope (S): Unchanged – The exploit cannot affect other components.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): Low – The attacker can send arbitrary emails, but cannot modify existing data.
• Availability (A): None – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the potential for abuse in phishing campaigns or spam distribution elevates the risk for site reputation and trust.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862). The plugin registers an AJAX action tslot_appt_email intended to send appointment notification emails. However, the handler function does not verify that the request originates from an authenticated user with appropriate capabilities (e.g., edit_posts or manage_options). Additionally, there is no nonce check to prevent Cross-Site Request Forgery (CSRF).

The AJAX action is hooked to both wp_ajax_tslot_appt_email (for authenticated users) and wp_ajax_nopriv_tslot_appt_email (for unauthenticated users). The nopriv hook is the root cause, as it allows anyone to call the function.

The function likely accepts parameters such as to, subject, and message (or similar) and passes them directly to wp_mail(). Without validation, an attacker can craft a POST request to /wp-admin/admin-ajax.php with action=tslot_appt_email and arbitrary email fields.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.4.7):

add_action('wp_ajax_tslot_appt_email', 'tslot_send_appt_email');
add_action('wp_ajax_nopriv_tslot_appt_email', 'tslot_send_appt_email');

function tslot_send_appt_email() {
    $to = sanitize_email($_POST['to']);
    $subject = sanitize_text_field($_POST['subject']);
    $message = wp_kses_post($_POST['message']);
    $headers = array('Content-Type: text/html; charset=UTF-8');
    wp_mail($to, $subject, $message, $headers);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_tslot_appt_email', 'tslot_send_appt_email');
// Remove the nopriv hook to require authentication
// add_action('wp_ajax_nopriv_tslot_appt_email', 'tslot_send_appt_email');

function tslot_send_appt_email() {
    // Add capability check
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    // Add nonce check
    if (!wp_verify_nonce($_POST['_wpnonce'], 'tslot_appt_email_nonce')) {
        wp_die('Invalid nonce', 403);
    }
    $to = sanitize_email($_POST['to']);
    $subject = sanitize_text_field($_POST['subject']);
    $message = wp_kses_post($_POST['message']);
    $headers = array('Content-Type: text/html; charset=UTF-8');
    wp_mail($to, $subject, $message, $headers);
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the vulnerable plugin (<= 1.4.7) installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the target WordPress site.
2. Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action=tslot_appt_email
   • to=attacker-controlled@example.com
   • subject=Your account has been compromised
   • message=<h1>Click here to reset your password</h1><a href="http://phishing-site.com">Reset Password</a>

Example cURL command:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -d "action=tslot_appt_email&to=attacker@example.com&subject=Test&message=Hello"

Expected Result: The email is sent to the specified recipient with the attacker-controlled content.

Blue Team

Detection Steps:

1. Monitor web server logs for POST requests to /wp-admin/admin-ajax.php with action=tslot_appt_email from unauthenticated IPs.
2. Check email server logs for unusual outbound email volume or emails sent to unexpected recipients.
3. Review WordPress user activity logs for any AJAX calls to this action.

Honeypot Setup:

• Deploy a decoy WordPress site with the vulnerable plugin.
• Monitor for any POST requests to the AJAX endpoint.
• Log the source IP and request body for analysis.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=tslot_appt_email from unauthenticated sources.
  • Outbound emails from the WordPress server to unexpected or suspicious recipients.
• File IOCs:
  • Modified plugin files (check file integrity via WordPress checksums).
  • Suspicious entries in wp-content/debug.log related to wp_mail failures.
• Log IOCs:
  • Web server logs showing repeated AJAX calls to the vulnerable action.
  • Email server logs showing a spike in outbound email volume.

Detection Engineering

YARA Rule

rule Detect_Vulnerable_TimeSlot_Plugin {
    meta:
        description = "Detects the vulnerable version of Booking Plugin for WordPress Appointments – Time Slot"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-12842"
    strings:
        $func = "tslot_send_appt_email" ascii wide
        $nopriv = "wp_ajax_nopriv_tslot_appt_email" ascii wide
        $wp_mail = "wp_mail" ascii wide
    condition:
        $func and $nopriv and $wp_mail
}

Sigma Rule

title: Detect CVE-2025-12842 Exploitation Attempts
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to the vulnerable AJAX action
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=tslot_appt_email"
    condition: selection
falsepositives:
    - Legitimate plugin functionality (if authentication is bypassed)
level: high

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2025-12842 - Unauthorized Email Sending via Time Slot Plugin";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=tslot_appt_email";
    http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove the nopriv hook from the plugin code (if you have custom development capabilities):
   • Comment out or delete the line: add_action('wp_ajax_nopriv_tslot_appt_email', 'tslot_send_appt_email');
3. Add capability checks to the AJAX handler function.

Long-term Mitigation:

1. Monitor the plugin vendor for an official patch.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=tslot_appt_email from unauthenticated users.
3. Restrict outbound email from the WordPress server to only authorized domains.
4. Enable email logging to detect abuse.

Workaround:

• Use a security plugin (e.g., Wordfence) to block AJAX requests from unauthenticated users.

Valters IT