CVE-2025-15527

Executive Summary

CVE-2025-15527 is an information exposure vulnerability in the WP Recipe Maker WordPress plugin, affecting versions up to and including 10.2.2. The flaw resides in the api_get_post_summary function, which fails to enforce proper authorization checks on which posts can be retrieved via the API. This allows authenticated attackers with at least Contributor-level access to extract sensitive data from posts they should not be able to read, including password-protected, private, or draft posts. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel for a patched version. Since no patch is available, temporary mitigation measures such as disabling the plugin or restricting API access should be considered.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires Contributor-level or higher authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited to reading post data
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)
• EPSS Score: 0.0% (low exploitation probability)

The threat level is considered Medium due to the low complexity and network-based attack vector, but the requirement for authentication reduces the overall risk.

Deep Dive & Mechanics

The vulnerability exists in the api_get_post_summary function within the WP Recipe Maker plugin. This function is intended to provide a summary of a post for use in recipe-related features. However, it does not properly validate whether the requesting user has permission to view the target post. The function likely retrieves post data based on a user-supplied post ID without checking the post’s status (e.g., draft, private, password-protected) or the user’s capabilities.

An authenticated attacker with Contributor-level access can craft a request to the vulnerable API endpoint, specifying the ID of a post they should not have access to. The function then returns the post summary, which may include the post title, excerpt, and other metadata. This information leakage could be used to gather intelligence about unpublished or restricted content.

The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key, as the post ID is directly used without proper access control checks.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (wp-recipe-maker/includes/class-wprm-api.php):

public function api_get_post_summary($request) {
    $post_id = $request->get_param('post_id');
    $post = get_post($post_id);
    // Missing authorization check
    return array(
        'title' => $post->post_title,
        'excerpt' => $post->post_excerpt,
        'status' => $post->post_status,
    );
}

Patched Code (Hypothetical):

public function api_get_post_summary($request) {
    $post_id = $request->get_param('post_id');
    $post = get_post($post_id);
    // Added authorization check
    if (!current_user_can('read_post', $post_id)) {
        return new WP_Error('rest_forbidden', __('You cannot view this post.'), array('status' => 403));
    }
    return array(
        'title' => $post->post_title,
        'excerpt' => $post->post_excerpt,
        'status' => $post->post_status,
    );
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP Recipe Maker plugin version <= 10.2.2
• Authenticated user account with Contributor-level access or higher
• Knowledge of a target post ID (e.g., a private or draft post)

Exploitation Steps:

1. Log in to WordPress with the Contributor account.
2. Obtain a nonce or API key if required by the plugin’s REST API.
3. Send a GET request to the vulnerable endpoint:

   GET /wp-json/wp-recipe-maker/v1/get-post-summary?post_id=TARGET_POST_ID
   

4. The response will contain the post summary data, including title, excerpt, and status.

Example cURL Command:

curl -X GET "https://target-site.com/wp-json/wp-recipe-maker/v1/get-post-summary?post_id=123" \
  -H "Cookie: wordpress_logged_in_xxx=..."

Blue Team

Detection:

• Monitor API access logs for unusual requests to /wp-json/wp-recipe-maker/v1/get-post-summary with varying post_id parameters.
• Look for patterns where a low-privileged user (Contributor) queries multiple post IDs in a short time.
• Alert on responses containing post_status values like draft, private, or password.

Hunting Query (Splunk):

index=web sourcetype=access_combined
uri="/wp-json/wp-recipe-maker/v1/get-post-summary"
| rex field=uri "post_id=(?<post_id>\d+)"
| stats count by user, post_id, status
| where count > 10

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-json/wp-recipe-maker/v1/get-post-summary with post_id parameter
  • Unusual number of API calls from a single authenticated user
• File IOCs:
  • Plugin file: wp-recipe-maker/includes/class-wprm-api.php (vulnerable version)
• Log IOCs:
  • WordPress debug log entries showing rest_forbidden errors (if patched)
  • Access logs with 200 responses to the vulnerable endpoint for restricted posts

Detection Engineering

YARA Rule

rule CVE_2025_15527_WP_Recipe_Maker {
    meta:
        description = "Detects vulnerable WP Recipe Maker plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15527"
    strings:
        $func = "api_get_post_summary"
        $no_check = "get_post("
    condition:
        $func and $no_check and not $check
}

Sigma Rule

title: CVE-2025-15527 - WP Recipe Maker Information Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts against CVE-2025-15527
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/wp-json/wp-recipe-maker/v1/get-post-summary"
    condition: selection
falsepositives:
    - Legitimate plugin usage
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-15527 - WP Recipe Maker Information Exposure Attempt";
    flow:to_server;
    content:"/wp-json/wp-recipe-maker/v1/get-post-summary";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Restrict API access using a Web Application Firewall (WAF) rule to block requests to /wp-json/wp-recipe-maker/v1/get-post-summary from non-admin users.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the official patch once released by the vendor.
• Implement a custom patch by adding authorization checks in the api_get_post_summary function (see patched code example).
• Upgrade to a patched version when available.

Workarounds:

• Use a WordPress security plugin to enforce role-based API access.
• Modify the .htaccess file to restrict access to the vulnerable endpoint:

  <IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_URI} ^/wp-json/wp-recipe-maker/v1/get-post-summary
  RewriteCond %{HTTP_COOKIE} !wordpress_logged_in_admin [NC]
  RewriteRule .* - [F,L]
  </IfModule>
  

Valters IT