CVE-2025-13753

Executive Summary

CVE-2025-13753 is a vulnerability in the WP Table Builder – Drag & Drop Table Builder plugin for WordPress, affecting all versions up to and including 2.0.19. The flaw resides in an incorrect authorization check within the save_table() function, allowing authenticated attackers with Subscriber-level access or higher to create new wptb-table posts without proper permission validation. This unauthorized modification of data can lead to content injection, defacement, or the creation of malicious tables that may be used for phishing or other attacks.

As this is a WordPress plugin vulnerability, the attack surface is limited to WordPress sites running the affected plugin. The CVSS score of 4.3 (Medium) reflects the low complexity and network-based attack vector, but the requirement for authentication reduces the immediate risk. However, given the widespread use of WordPress, the impact could be significant if exploited in combination with other vulnerabilities.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The save_table() function lacks a proper capability check, allowing any authenticated user (including Subscribers) to create posts of the custom post type wptb-table. This bypasses the intended role-based access controls.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Attacker needs a valid WordPress account (Subscriber or higher).
• User Interaction: None (UI:N) – No victim action needed.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: Low (I:L) – Unauthorized creation of posts.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the impact is limited to creating posts, an attacker could use this to inject malicious content, deface the site, or create tables that serve as phishing lures. The low EPSS score (0.0%) suggests no active exploitation in the wild, but the lack of a patch increases risk.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862) in the save_table() function of the WP Table Builder plugin. This function is responsible for saving table data via AJAX requests. The plugin registers an AJAX action for both authenticated and unauthenticated users, but the authenticated handler fails to verify that the current user has the necessary capabilities (e.g., edit_posts or publish_posts) to create new wptb-table posts.

Technical Flow:

1. An authenticated user (e.g., Subscriber) sends a POST request to wp-admin/admin-ajax.php with action wptb_save_table.
2. The plugin's save_table() function is called.
3. The function checks for a nonce but does not perform a capability check (e.g., current_user_can('edit_posts')).
4. The function creates a new wptb-table post using wp_insert_post() with the attacker-controlled data.
5. The post is created, and the attacker can then view or manipulate it.

Root Cause: The developer assumed that only users with higher privileges would have access to the AJAX endpoint, but WordPress allows any authenticated user to call AJAX actions. The missing current_user_can() check is the flaw.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.0.19):

add_action('wp_ajax_wptb_save_table', array($this, 'save_table'));

public function save_table() {
    // Nonce verification
    if (!wp_verify_nonce($_POST['_wpnonce'], 'wptb_save_table')) {
        wp_die('Security check failed.');
    }
    // Missing capability check
    $post_data = array(
        'post_title'   => sanitize_text_field($_POST['title']),
        'post_content' => wp_kses_post($_POST['content']),
        'post_type'    => 'wptb-table',
        'post_status'  => 'publish',
    );
    $post_id = wp_insert_post($post_data);
    // ...
}

Patched Code (Hypothetical):

add_action('wp_ajax_wptb_save_table', array($this, 'save_table'));

public function save_table() {
    // Nonce verification
    if (!wp_verify_nonce($_POST['_wpnonce'], 'wptb_save_table')) {
        wp_die('Security check failed.');
    }
    // Added capability check
    if (!current_user_can('edit_posts')) {
        wp_die('You do not have permission to create tables.');
    }
    $post_data = array(
        'post_title'   => sanitize_text_field($_POST['title']),
        'post_content' => wp_kses_post($_POST['content']),
        'post_type'    => 'wptb-table',
        'post_status'  => 'publish',
    );
    $post_id = wp_insert_post($post_data);
    // ...
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP Table Builder plugin <= 2.0.19.
• A valid user account with Subscriber role or higher.
• Access to the WordPress admin AJAX endpoint.

Exploitation Steps:

1. Log in as a Subscriber user.
2. Obtain a valid nonce by inspecting the page source or using a tool like Burp Suite.
3. Send a crafted POST request to wp-admin/admin-ajax.php:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-wordpress-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: [valid WordPress auth cookie]

action=wptb_save_table&_wpnonce=[valid_nonce]&title=Malicious+Table&content=<script>alert('XSS')</script>

4. The plugin creates a new wptb-table post with the attacker-controlled content.
5. The attacker can then view the table on the frontend, potentially triggering XSS if the content is not properly sanitized.

Note: No public exploit code is available, but the above steps demonstrate the vulnerability.

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action wptb_save_table from low-privilege users.
• Look for unusual creation of wptb-table posts by Subscriber or Contributor roles.
• Check for nonce reuse or brute-force attempts.

Hardening:

• Apply the principle of least privilege: ensure only Editor and Administrator roles can create tables.
• Use a Web Application Firewall (WAF) to block suspicious AJAX requests.
• Monitor for plugin updates and apply patches immediately when available.
• Implement additional capability checks via a custom plugin or mu-plugin.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=wptb_save_table from low-privilege users.
  • Unusual frequency of AJAX requests from a single user.
• Host:
  • Unexpected wptb-table posts in the WordPress database.
  • Log entries showing wp_insert_post calls for wptb-table post type by Subscriber users.
• File:
  • Modified or new table content containing suspicious HTML/JavaScript.

Detection Engineering

YARA Rule

rule CVE_2025_13753_WP_Table_Builder {
    meta:
        description = "Detects vulnerable WP Table Builder plugin files with missing authorization"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13753"
    strings:
        $func = "save_table" ascii wide nocase
        $ajax = "wp_ajax_wptb_save_table" ascii wide nocase
        $missing = "current_user_can" ascii wide nocase
    condition:
        $func and $ajax and not $missing
}

Sigma Rule

title: CVE-2025-13753 - WP Table Builder Unauthorized Table Creation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects AJAX requests to create wptb-table posts without proper authorization
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /wp-admin/admin-ajax.php
        cs-uri-query: action=wptb_save_table
    condition: selection
falsepositives:
    - Legitimate table creation by authorized users
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-13753 - WP Table Builder Unauthorized Table Creation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=wptb_save_table"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-13753;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential, or restrict access to the AJAX endpoint via .htaccess or a WAF.
2. Manually patch by adding a capability check in the save_table() function (see patched code above).
3. Audit user roles and remove unnecessary Subscriber accounts.

Long-term Fix:

• Apply the official patch when released by the vendor.
• Implement a Content Security Policy (CSP) to mitigate potential XSS from injected table content.
• Regularly update all WordPress plugins and themes.

Workaround:

• Use a plugin like "User Role Editor" to restrict the edit_posts capability for Subscribers, preventing them from creating any posts.

Valters IT
Securing Digital Frontiers