CVE-2025-14428

Executive Summary

CVE-2025-14428 is a medium-severity vulnerability affecting the WordPress plugin "All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements" (versions up to and including 2.3.3). The vulnerability resides in the my_sticky_elements_bulks function, which lacks a proper capability check. This allows authenticated attackers with Subscriber-level access or higher to delete all contact form leads stored by the plugin, leading to unauthorized data loss.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx. The plugin is developed by Premio and is widely used for adding sticky contact forms and social icons to WordPress sites.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of the plugin files and ensure they are obtained from trusted sources. No known supply chain compromise has been reported for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: Low (Data loss of leads)

The threat level is considered medium due to the low privileges required and the potential for data loss, though the impact is limited to the plugin's stored leads.

Deep Dive & Mechanics

The vulnerability is caused by a missing capability check in the my_sticky_elements_bulks function. This function is responsible for handling bulk actions, including the deletion of contact form leads. In WordPress, functions that perform sensitive operations should check for appropriate user capabilities (e.g., manage_options or edit_posts). However, in this case, the function does not verify that the user has the necessary permissions before executing the deletion.

The function is likely hooked into an AJAX action or a POST request handler. An authenticated attacker with Subscriber-level access can craft a request to trigger the bulk deletion of all leads. The lack of a nonce check or capability verification makes this exploitation straightforward.

The vulnerable code path is:

1. User sends a POST request to the WordPress admin-ajax.php or a custom endpoint.
2. The my_sticky_elements_bulks function is called.
3. The function processes the request and deletes leads from the database without checking if the user has the required capabilities.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.3.3):

function my_sticky_elements_bulks() {
    // No capability check
    if (isset($_POST['action']) && $_POST['action'] == 'my_sticky_elements_bulks') {
        // Process bulk deletion
        $lead_ids = $_POST['lead_ids'];
        foreach ($lead_ids as $id) {
            // Delete lead from database
            global $wpdb;
            $wpdb->delete($wpdb->prefix . 'my_sticky_elements_leads', array('id' => $id));
        }
    }
}

Patched Code (Hypothetical):

function my_sticky_elements_bulks() {
    // Check user capability
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'my_sticky_elements_bulks_nonce')) {
        wp_die('Nonce verification failed');
    }
    if (isset($_POST['action']) && $_POST['action'] == 'my_sticky_elements_bulks') {
        // Process bulk deletion
        $lead_ids = $_POST['lead_ids'];
        foreach ($lead_ids as $id) {
            // Delete lead from database
            global $wpdb;
            $wpdb->delete($wpdb->prefix . 'my_sticky_elements_leads', array('id' => $id));
        }
    }
}

The patched code adds a capability check (current_user_can('manage_options')) and a nonce verification to prevent unauthorized access.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the vulnerable plugin installed (version <= 2.3.3).
• An authenticated user account with Subscriber-level access.

Exploitation Steps:

1. Log in to WordPress as a Subscriber.
2. Craft a POST request to the WordPress admin-ajax.php endpoint with the following parameters:
   • action: my_sticky_elements_bulks
   • lead_ids[]: Array of lead IDs to delete (e.g., 1, 2, 3).
3. Send the request using a tool like cURL or Burp Suite.

Example cURL Command:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=my_sticky_elements_bulks&lead_ids[]=1&lead_ids[]=2&lead_ids[]=3" \
  --cookie "wordpress_logged_in_<hash>=<session_cookie>"

Expected Outcome: All specified leads are deleted from the database.

Blue Team

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with the action parameter set to my_sticky_elements_bulks.
• Look for unusual patterns of lead deletion, especially from low-privileged users.
• Check for missing nonce or capability checks in the plugin code.

Mitigation:

• Immediately update the plugin to a patched version if available.
• If no patch is available, disable the plugin or restrict access to the vulnerable function via a custom plugin or WordPress filter.
• Implement Web Application Firewall (WAF) rules to block requests to the vulnerable endpoint from low-privileged users.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=my_sticky_elements_bulks.
  • Unusual volume of lead deletion requests from a single user.
• File IOCs:
  • Modified plugin files (e.g., my-sticky-elements/my-sticky-elements.php).
• Database IOCs:
  • Missing or truncated records in the wp_my_sticky_elements_leads table.
• Log IOCs:
  • WordPress debug logs showing unauthorized access attempts to the my_sticky_elements_bulks function.

Detection Engineering

YARA Rule

rule CVE_2025_14428_My_Sticky_Elements {
    meta:
        description = "Detects vulnerable My Sticky Elements plugin files"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-14428"
    strings:
        $func = "my_sticky_elements_bulks"
        $no_cap = "current_user_can" nocase
    condition:
        $func and not $no_cap
}

Sigma Rule

title: CVE-2025-14428 - Unauthorized Lead Deletion via My Sticky Elements
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit missing capability check in My Sticky Elements plugin
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'action=my_sticky_elements_bulks'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-14428 - My Sticky Elements Unauthorized Lead Deletion";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=my_sticky_elements_bulks";
    http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2025-14428;
)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the plugin if no patch is available.
   • Restrict access to the vulnerable function by adding a capability check via a custom plugin or WordPress filter.
   • Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=my_sticky_elements_bulks from non-admin users.

2. Long-term Fix:

   • Update the plugin to a patched version once released by the vendor.
   • Regularly audit WordPress plugins for missing capability checks and other security issues.
   • Follow the principle of least privilege for user roles.

3. Monitoring:

   • Enable WordPress debug logging to track unauthorized access attempts.
   • Monitor database tables for unexpected deletions.

Valters IT
Securing Digital Frontiers