CVE-2025-24596

Executive Summary

CVE-2025-24596 is a Missing Authorization vulnerability in the WooCommerce Product Table Lite WordPress plugin, affecting versions up to and including 3.8.7. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data exposure or manipulation of product table configurations. The vulnerability is classified as a WordPress ecosystem issue and does not involve server-level components like Apache or Nginx.

The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. However, due to the lack of a patch, it poses a persistent risk to sites running the affected plugin version.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. As such, it is part of the WordPress supply chain. Users should monitor the plugin’s update channel for a patched version and consider disabling the plugin if no patch is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthorized access to potentially sensitive product table data but does not enable data modification or denial of service.

Deep Dive & Mechanics

The vulnerability resides in the WooCommerce Product Table Lite plugin, specifically in its access control mechanisms. The plugin fails to properly validate user permissions when processing certain AJAX requests or REST API endpoints related to product table configuration and data retrieval.

Root Cause: The plugin uses wp_ajax_* and wp_ajax_nopriv_* hooks without adequate capability checks. This allows unauthenticated users to trigger actions that should require administrative or shop manager privileges.

Attack Vector: An attacker can send crafted HTTP requests to the WordPress site, targeting the vulnerable endpoints. For example, a request to /wp-admin/admin-ajax.php with the appropriate action parameter can retrieve product table data or modify settings without authentication.

Impact: Successful exploitation could lead to:

• Unauthorized disclosure of product table configurations.
• Exposure of sensitive product data (e.g., pricing, stock levels).
• Potential manipulation of table display settings (if write access is also missing).

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes for missing authorization vulnerabilities.

Vulnerable Code (Example):

add_action('wp_ajax_nopriv_get_product_table_data', 'get_product_table_data');
function get_product_table_data() {
    // No capability check
    $table_id = $_POST['table_id'];
    $data = get_post_meta($table_id, '_product_table_data', true);
    wp_send_json_success($data);
}

Patched Code (Hypothetical):

add_action('wp_ajax_nopriv_get_product_table_data', 'get_product_table_data');
function get_product_table_data() {
    // Added capability check
    if (!current_user_can('edit_shop_orders')) {
        wp_send_json_error('Unauthorized');
        return;
    }
    $table_id = $_POST['table_id'];
    $data = get_post_meta($table_id, '_product_table_data', true);
    wp_send_json_success($data);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WooCommerce Product Table Lite <= 3.8.7 installed and active.
• Network access to the target site.

Exploitation Steps:

1. Identify the vulnerable endpoint by analyzing the plugin’s JavaScript files or source code.
2. Send a crafted POST request to /wp-admin/admin-ajax.php with the action parameter set to the vulnerable function (e.g., get_product_table_data).
3. Include any required parameters (e.g., table_id) to retrieve data.

Example Request (using cURL):

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -d "action=get_product_table_data&table_id=123"

Expected Output: JSON response containing product table data.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual AJAX requests to /wp-admin/admin-ajax.php with unknown or suspicious action parameters.
• Look for requests from unauthenticated users to endpoints that should require authentication.

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to vulnerable endpoints from unauthenticated users.
• Use a security plugin (e.g., Wordfence) to add virtual patching.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action parameters like get_product_table_data, save_product_table_settings, or similar.
  • Unusual JSON responses containing product table metadata.

• File IOCs:

  • Modified plugin files in /wp-content/plugins/wc-product-table-lite/ (if exploitation leads to file changes).

• Log IOCs:

  • WordPress debug log entries showing unauthorized AJAX calls.
  • Web server access logs with 200 responses to /wp-admin/admin-ajax.php from unauthenticated IPs.

Detection Engineering

YARA Rule

rule Detect_WooCommerce_Product_Table_Lite_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2025-24596"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24596"
    strings:
        $ajax_action = "action=get_product_table_data"
        $ajax_action2 = "action=save_product_table_settings"
        $plugin_path = "wp-content/plugins/wc-product-table-lite"
    condition:
        any of ($ajax_action*) and $plugin_path
}

Sigma Rule

title: WooCommerce Product Table Lite Missing Authorization Exploit
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized AJAX requests to vulnerable endpoints in WooCommerce Product Table Lite
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=get_product_table_data'
    condition: selection
falsepositives:
    - Legitimate admin actions (if authenticated)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-24596 - WooCommerce Product Table Lite Missing Authorization Exploit";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=get_product_table_data";
    http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical for business operations.
2. Apply virtual patching using a WAF or security plugin to block unauthenticated access to the vulnerable endpoints.
3. Monitor logs for any signs of exploitation.

Long-Term Fix:

• Wait for the vendor to release a patched version (e.g., > 3.8.7). Once available, update immediately.
• If the vendor does not patch, consider migrating to an alternative WooCommerce product table plugin.

Workaround:

• Add a custom code snippet to your theme’s functions.php to enforce capability checks on the vulnerable hooks:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX) {
        // Block unauthenticated access to specific actions
        $blocked_actions = array('get_product_table_data', 'save_product_table_settings');
        if (in_array($_REQUEST['action'], $blocked_actions) && !is_user_logged_in()) {
            wp_die('Unauthorized', 403);
        }
    }
});

Valters IT
Securing Digital Frontiers