CVE-2025-15520

Executive Summary

CVE-2025-15520 is a vulnerability in the RegistrationMagic WordPress plugin (versions before 6.0.7.2) that allows authenticated users with Subscriber-level privileges or above to access sensitive data. The root cause is a missing capability check in the plugin’s AJAX handlers. While nonces are properly validated to prevent Cross-Site Request Forgery (CSRF), the plugin fails to verify that the requesting user has the necessary WordPress capabilities (e.g., manage_options, edit_posts) to access the data. This flaw enables low-privilege users to enumerate registration data, form configurations, and potentially other sensitive information stored by the plugin.

This vulnerability is particularly dangerous in multi-tenant WordPress environments (e.g., membership sites, e-learning platforms) where subscribers can register and interact with forms. An attacker with a Subscriber account can exploit this to harvest data from other users’ registrations, leading to privacy breaches and potential identity theft.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Users are advised to update the plugin directly from their WordPress admin dashboard or by downloading the latest version from wordpress.org. No supply chain compromise has been reported; the flaw exists in the plugin’s own authorization logic.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely via HTTP requests.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs a valid Subscriber account.
• Privileges Required (PR): Low (L) – The attacker must be authenticated as a Subscriber or higher.
• User Interaction (UI): None (N) – No user interaction is required beyond the attacker’s own actions.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited disclosure of sensitive registration data.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No denial of service.

CVSS Score: 4.3 (Medium) – The low privileges required and network attack vector make this a realistic threat for WordPress sites with untrusted user registrations.

Deep Dive & Mechanics

The RegistrationMagic plugin uses AJAX actions to handle form submissions, data retrieval, and administrative tasks. In versions prior to 6.0.7.2, the plugin’s AJAX handlers implement nonce checks to prevent CSRF but omit capability checks. For example, the handler for retrieving form submissions (e.g., rm_user_submissions) checks a nonce but does not verify that the current user has the manage_options capability or is the owner of the data.

Vulnerable Code Path:

1. A Subscriber logs in and obtains a valid nonce from the page source.
2. The attacker sends a crafted AJAX request to /wp-admin/admin-ajax.php with the action parameter set to a privileged endpoint (e.g., rm_get_all_submissions).
3. The plugin validates the nonce (passes) but does not call current_user_can() to check capabilities.
4. The plugin returns the requested data, which may include other users’ registration details, form settings, or export data.

Impacted Data Types:

• User registration data (names, emails, custom fields)
• Form configurations and field mappings
• Payment transaction logs (if using paid add-ons)
• Export files containing bulk user data

Vulnerable vs. Patched Code

Vulnerable Code (pre-6.0.7.2):

add_action('wp_ajax_rm_get_all_submissions', 'rm_get_all_submissions_handler');
function rm_get_all_submissions_handler() {
    check_ajax_referer('rm_ajax_nonce', 'nonce');
    // Missing capability check
    $submissions = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}rm_submissions");
    wp_send_json_success($submissions);
}

Patched Code (6.0.7.2+):

add_action('wp_ajax_rm_get_all_submissions', 'rm_get_all_submissions_handler');
function rm_get_all_submissions_handler() {
    check_ajax_referer('rm_ajax_nonce', 'nonce');
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $submissions = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}rm_submissions");
    wp_send_json_success($submissions);
}

The patch adds a current_user_can('manage_options') check, ensuring only administrators can access the data. Similar checks should be applied to all AJAX handlers that expose sensitive information.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with RegistrationMagic plugin version < 6.0.7.2.
• A valid Subscriber account (username: attacker, password: attacker123).

Exploitation Steps:

1. Obtain Nonce: Log in as the Subscriber and view the page source of any RegistrationMagic form. Look for a JavaScript variable like rm_ajax_nonce or inspect network requests to find a valid nonce.

2. Craft AJAX Request: Use a tool like curl or Burp Suite to send a POST request to the WordPress AJAX endpoint.

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "action=rm_get_all_submissions&nonce=VALID_NONCE_HERE"
   

3. Parse Response: The server will return a JSON object containing all submissions, including other users’ data.

   {
     "success": true,
     "data": [
       {
         "submission_id": 1,
         "form_id": 2,
         "user_email": "admin@example.com",
         "field_data": {"first_name": "Admin", "last_name": "User"}
       }
     ]
   }
   

4. Automate Extraction: Write a script to iterate over all available AJAX actions (e.g., rm_get_form_settings, rm_export_data) to maximize data exfiltration.

Blue Team (Defender)

Detection & Response:

1. Monitor AJAX Requests: Look for unusual patterns in /wp-admin/admin-ajax.php requests from low-privilege users (Subscriber role). Specifically, monitor for actions prefixed with rm_ that are typically admin-only.

2. Log Analysis: Enable WordPress debug logging (WP_DEBUG_LOG) and monitor for 403 errors after patching. In unpatched systems, look for successful AJAX responses containing large JSON payloads from Subscriber accounts.

3. User Behavior Analytics: Flag Subscriber accounts that make an abnormally high number of AJAX requests to admin endpoints within a short time frame.

4. Honeypot: Create a fake RegistrationMagic form with a honeytoken field. Monitor for the token appearing in logs or external systems, indicating data exfiltration.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action parameters like rm_get_all_submissions, rm_export_data, rm_get_form_settings from non-admin IPs.
  • Response bodies containing JSON arrays with keys like submission_id, form_id, user_email, field_data.

• Host IOCs:

  • Unusual database queries in the MySQL slow query log: SELECT * FROM wp_rm_submissions executed by non-admin users.
  • WordPress debug log entries showing successful AJAX responses to Subscriber users for admin actions.

• File IOCs:

  • Presence of export files (e.g., registration-data-*.csv) in the WordPress uploads directory created by Subscriber accounts.

Detection Engineering

YARA Rule

rule Detect_RegistrationMagic_Data_Exfil {
    meta:
        description = "Detects AJAX requests exploiting CVE-2025-15520 in RegistrationMagic plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15520"
    strings:
        $ajax_action = "action=rm_" ascii wide nocase
        $nonce_param = "nonce=" ascii wide nocase
        $submission_data = "\"submission_id\":" ascii wide
        $form_data = "\"form_id\":" ascii wide
    condition:
        all of ($ajax_action, $nonce_param) and any of ($submission_data, $form_data)
}

Sigma Rule

title: RegistrationMagic Data Exfiltration via AJAX
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects AJAX requests from low-privilege users to RegistrationMagic admin endpoints
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=rm_'
            - 'nonce='
    condition: selection
falsepositives:
    - Legitimate admin users performing administrative tasks
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-15520 RegistrationMagic Data Exfiltration Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=rm_"; http_client_body;
    content:"nonce="; http_client_body;
    pcre:"/rm_(get_all_submissions|export_data|get_form_settings)/Ri";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Upgrade RegistrationMagic to version 6.0.7.2 or later. This can be done via the WordPress admin dashboard under Plugins → Installed Plugins → RegistrationMagic → Update Now.
2. Audit User Roles: Review all Subscriber accounts and remove any that are not necessary. Consider disabling user registration if not required.
3. Revoke Nonces: After updating, force all users to re-login to invalidate old nonces. This can be done by changing the WordPress secret keys in wp-config.php.

Long-Term Hardening:

1. Implement Capability Checks: For any custom WordPress plugins, ensure all AJAX handlers include current_user_can() checks appropriate to the data being accessed.
2. Web Application Firewall (WAF): Deploy a WAF rule to block AJAX requests to admin endpoints from non-admin users. Example ModSecurity rule:

   SecRule REQUEST_URI "/wp-admin/admin-ajax.php" \
     "chain,id:1000002,deny,msg:'RegistrationMagic data exfiltration'"
   SecRule ARGS:action "^rm_" \
     "chain"
   SecRule USER:role "!^administrator$"
   

3. Monitor Plugin Updates: Subscribe to the WordPress Plugin Security mailing list or use a vulnerability scanner to stay informed about plugin vulnerabilities.

Valters IT – Securing WordPress ecosystems one patch at a time.