CVE-2025-13092

Executive Summary

CVE-2025-13092 is a critical information disclosure vulnerability affecting the Devs CRM WordPress plugin (versions up to and including 1.1.8). The plugin fails to enforce proper authorization checks on the /wp-json/devs-crm/v1/attendances REST API endpoint, allowing unauthenticated attackers to retrieve sensitive user data, including password hashes. This vulnerability is classified as CWE-862 (Missing Authorization) and has a CVSS score of 5.3 (Medium). No official patch has been released as of the latest advisory.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and is not an NPM, PyPI, Go, or Ruby package. Therefore, supply chain security concerns are limited to WordPress plugin updates and the integrity of the plugin's codebase.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure (password hashes).
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No service disruption.

Threat Level: Medium. While the CVSS score is 5.3, the exposure of password hashes can lead to credential compromise and lateral movement if hashes are cracked.

Deep Dive & Mechanics

The vulnerability resides in the REST API endpoint /wp-json/devs-crm/v1/attendances. The plugin registers this endpoint using WordPress's REST API infrastructure but fails to include a capability check (e.g., current_user_can()) in the callback function. This allows any unauthenticated HTTP request to the endpoint to retrieve attendance records, which inadvertently include user data such as password hashes.

The affected code likely resembles:

register_rest_route('devs-crm/v1', '/attendances', array(
    'methods' => 'GET',
    'callback' => 'devs_crm_get_attendances',
));

The callback function devs_crm_get_attendances queries the database for attendance records and returns them without verifying user permissions.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.1.8):

function devs_crm_get_attendances($request) {
    global $wpdb;
    $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}devs_crm_attendances");
    return new WP_REST_Response($results, 200);
}

Patched Code (Hypothetical):

function devs_crm_get_attendances($request) {
    if (!current_user_can('manage_options')) {
        return new WP_Error('rest_forbidden', 'You do not have permission to access this data.', array('status' => 403));
    }
    global $wpdb;
    $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}devs_crm_attendances");
    return new WP_REST_Response($results, 200);
}

The patch adds a capability check (manage_options) to restrict access to administrators only.

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify WordPress sites using the Devs CRM plugin via Shodan dorks or Google dorking.
2. Exploit: Send a GET request to the vulnerable endpoint:

   curl -X GET "http://target.com/wp-json/devs-crm/v1/attendances"
   

3. Data Extraction: The response will contain JSON data including user password hashes (likely MD5 or bcrypt). Example response:

   [
       {
           "id": 1,
           "user_id": 1,
           "user_login": "admin",
           "user_pass": "$P$Bhashedpassword",
           "attendance_date": "2025-03-01"
       }
   ]
   

4. Post-Exploitation: Crack the password hashes offline using tools like Hashcat or John the Ripper.

Blue Team

1. Detection: Monitor for unauthorized access to /wp-json/devs-crm/v1/attendances from unknown IPs.
2. Mitigation: Disable the plugin immediately if no patch is available. Alternatively, implement a web application firewall (WAF) rule to block requests to the vulnerable endpoint.
3. Forensics: Check access logs for suspicious GET requests to the endpoint. Extract any leaked data and force password resets for affected users.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /wp-json/devs-crm/v1/attendances from unauthenticated sources.
• File: Presence of the plugin directory /wp-content/plugins/devs-crm/ with version <= 1.1.8.
• Log: WordPress REST API logs showing requests to the devs-crm/v1/attendances route without authentication.

Detection Engineering

YARA Rule

rule detect_devs_crm_vuln {
    meta:
        description = "Detects CVE-2025-13092 exploitation attempts in web logs"
        author = "Valters IT"
        date = "2025-03-01"
    strings:
        $endpoint = "/wp-json/devs-crm/v1/attendances"
        $method = "GET"
    condition:
        $endpoint and $method
}

Sigma Rule

title: CVE-2025-13092 - Unauthenticated Access to Devs CRM Attendances
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthenticated GET requests to the vulnerable Devs CRM REST API endpoint.
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/wp-json/devs-crm/v1/attendances'
    condition: selection
falsepositives:
    - Legitimate admin access (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13092 - Devs CRM Unauthenticated Access"; flow:to_server; http.method; content:"GET"; http.uri; content:"/wp-json/devs-crm/v1/attendances"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Devs CRM plugin until an official patch is released.
2. Workaround: Implement a WAF rule to block requests to /wp-json/devs-crm/v1/attendances from non-admin IPs.
3. Long-term: Monitor the plugin's update page for a patched version (> 1.1.8). Apply the patch as soon as it becomes available.
4. User Notification: Force password resets for all users whose data may have been exposed.
5. Code Review: If you have access to the plugin source, add capability checks to all REST API endpoints.

Valters IT
Securing Digital Frontiers