CVE-2025-12953

Executive Summary

CVE-2025-12953 is a Missing Authorization vulnerability in the Classified Listing – AI-Powered Classified ads & Business Directory Plugin for WordPress, affecting all versions up to and including 5.2.0. The vulnerability resides in three AJAX handler functions: rtcl_ajax_add_listing_type, rtcl_ajax_update_listing_type, and rtcl_ajax_delete_listing_type. These functions lack a proper capability check, allowing authenticated attackers with subscriber-level access or higher to add, update, or delete listing types without authorization.

This vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx. The CVSS score is 4.3 (Medium), with a low attack complexity and no requirement for user interaction. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time. No public proof-of-concept (PoC) or exploit code is available, but the risk is elevated due to the lack of a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates and apply patches as soon as they become available. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber+)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the impact is limited to integrity (unauthorized modification of listing types), the low barrier to entry (subscriber-level access) and lack of a patch make it a viable target for attackers seeking to deface or manipulate classified listings.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862). The plugin registers AJAX actions for authenticated users without verifying that the user has the appropriate capabilities (e.g., manage_options or edit_posts). The affected functions are:

• rtcl_ajax_add_listing_type – Allows adding new listing types.
• rtcl_ajax_update_listing_type – Allows updating existing listing types.
• rtcl_ajax_delete_listing_type – Allows deleting listing types.

An attacker with subscriber-level access can craft AJAX requests to these endpoints, bypassing intended access controls. The functions likely process POST data and interact with the database to manage custom post types or taxonomy terms.

Attack Flow:

1. Attacker authenticates as a subscriber.
2. Attacker sends a crafted POST request to /wp-admin/admin-ajax.php with action=rtcl_ajax_add_listing_type and required parameters.
3. The plugin processes the request without checking user capabilities.
4. Listing type is added, updated, or deleted.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example based on common patterns):

add_action('wp_ajax_rtcl_ajax_add_listing_type', 'rtcl_ajax_add_listing_type');
function rtcl_ajax_add_listing_type() {
    // No capability check
    $name = sanitize_text_field($_POST['name']);
    // Process and add listing type
    update_option('rtcl_listing_types', $types);
    wp_die();
}

Patched Code (expected fix):

add_action('wp_ajax_rtcl_ajax_add_listing_type', 'rtcl_ajax_add_listing_type');
function rtcl_ajax_add_listing_type() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $name = sanitize_text_field($_POST['name']);
    // Process and add listing type
    update_option('rtcl_listing_types', $types);
    wp_die();
}

The patch should add current_user_can('manage_options') or a similar capability check before processing the request.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Classified Listing plugin <= 5.2.0.
• Valid subscriber account credentials.

Exploitation Steps:

1. Log in as a subscriber.
2. Obtain a nonce if required (the plugin may or may not use nonces; if missing, exploitation is simpler).
3. Send a POST request to add a new listing type:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=rtcl_ajax_add_listing_type&name=MaliciousType&slug=malicious" \
  --cookie "wordpress_logged_in_xxx=..."

4. Verify the new listing type appears in the admin interface.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with actions rtcl_ajax_add_listing_type, rtcl_ajax_update_listing_type, or rtcl_ajax_delete_listing_type from non-admin users.
• Alert on any modification to listing types by users with subscriber or contributor roles.

Hardening:

• Apply the patch as soon as it becomes available.
• Temporarily disable the plugin if not critical.
• Use a Web Application Firewall (WAF) to block suspicious AJAX requests.
• Restrict subscriber capabilities via a plugin like "User Role Editor".

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=rtcl_ajax_add_listing_type, rtcl_ajax_update_listing_type, or rtcl_ajax_delete_listing_type.
  • Unusual listing type names or slugs in the database (e.g., wp_options table with rtcl_listing_types option).

• File IOCs:

  • Modified plugin files (e.g., class-listing-type.php or similar) if the attacker uploads a backdoor.

• Log IOCs:

  • WordPress debug log entries showing AJAX errors or unauthorized access attempts.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_12953_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2025-12953 in WordPress Classified Listing plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12953"
    strings:
        $ajax_action1 = "rtcl_ajax_add_listing_type"
        $ajax_action2 = "rtcl_ajax_update_listing_type"
        $ajax_action3 = "rtcl_ajax_delete_listing_type"
        $admin_ajax = "admin-ajax.php"
    condition:
        any of ($ajax_action*) and $admin_ajax
}

Sigma Rule

title: CVE-2025-12953 - Unauthorized Listing Type Modification
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized AJAX requests to modify listing types in WordPress Classified Listing plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=rtcl_ajax_add_listing_type'
            - 'action=rtcl_ajax_update_listing_type'
            - 'action=rtcl_ajax_delete_listing_type'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-12953 - Unauthorized Listing Type Modification Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=rtcl_ajax_add_listing_type"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2025-12953;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential for business operations.
2. Apply the patch as soon as the vendor releases an update (monitor the WordPress plugin repository).
3. Restrict subscriber capabilities using a security plugin (e.g., "User Role Editor" to remove read capability if possible, or use a custom role with minimal permissions).

Long-term Measures:

• Implement a Web Application Firewall (WAF) with rules to block unauthorized AJAX actions.
• Regularly audit WordPress plugins for missing authorization vulnerabilities.
• Enforce the principle of least privilege for all user roles.

Workaround:

• Add a custom capability check via a mu-plugin:

add_action('wp_ajax_rtcl_ajax_add_listing_type', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}, 1);

Valters IT
Securing Digital Frontiers