CVE-2025-24600

Executive Summary

CVE-2025-24600 is a Missing Authorization vulnerability in the RSVPMarker WordPress plugin (versions <= 11.4.5) by developer davidfcarr. This flaw allows unauthenticated attackers to bypass authorization checks, potentially accessing sensitive event data or performing unauthorized actions. The vulnerability has a CVSS score of 5.3 (Medium) and currently has no known public exploit or patch. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains for unpatched installations.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. RSVPMarker is distributed via the official WordPress plugin repository. Users should verify they are not running version 11.4.5 or earlier. No official patch has been released by the vendor, making this a supply chain risk for any site using the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The threat level is Medium due to the low complexity and no required privileges, but the impact is limited to confidentiality.

Deep Dive & Mechanics

The vulnerability resides in the RSVPMarker plugin's authorization logic. The plugin fails to properly validate user permissions when accessing certain REST API endpoints or AJAX actions. Specifically, the rsvpmaker plugin does not enforce capability checks for functions that retrieve or modify event data. An unauthenticated attacker can send crafted HTTP requests to endpoints such as /wp-json/rsvpmaker/v1/... or direct AJAX handlers to access private event details, attendee lists, or other sensitive information.

The missing authorization check likely occurs in the rsvpmaker_ajax_handler or similar functions where current_user_can() is not called before processing requests. This allows any visitor to the site to query data that should be restricted to administrators or event organizers.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code remains in versions <= 11.4.5. A hypothetical patch would add capability checks:

Vulnerable Code (example):

add_action('wp_ajax_nopriv_rsvpmaker_get_events', 'rsvpmaker_get_events');
function rsvpmaker_get_events() {
    // No authorization check
    $events = get_posts(array('post_type' => 'rsvpmaker_event'));
    wp_send_json($events);
}

Patched Code (hypothetical):

add_action('wp_ajax_nopriv_rsvpmaker_get_events', 'rsvpmaker_get_events');
function rsvpmaker_get_events() {
    if (!current_user_can('read_private_rsvpmaker_events')) {
        wp_die('Unauthorized', 403);
    }
    $events = get_posts(array('post_type' => 'rsvpmaker_event'));
    wp_send_json($events);
}

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would send a crafted HTTP request to the WordPress site. Since no public exploit exists, the following is a conceptual proof-of-concept:

curl -X GET "http://target.com/wp-json/rsvpmaker/v1/events" -H "User-Agent: Mozilla/5.0"

If the endpoint returns event data without authentication, the vulnerability is confirmed. Attackers could also enumerate attendee lists or modify event settings if other endpoints are exposed.

Lab Setup:

1. Install WordPress with RSVPMarker plugin version 11.4.5.
2. Create a few test events with private visibility.
3. Use Burp Suite or curl to access the REST API endpoints without authentication.
4. Observe if sensitive data is returned.

Blue Team

To detect exploitation attempts, monitor for:

• Unauthenticated requests to /wp-json/rsvpmarker/v1/* or /wp-admin/admin-ajax.php with action=rsvpmarker_* parameters.
• Anomalous spikes in 200 responses to these endpoints from unknown IPs.
• Log entries showing access to private event data without a valid session.

Detection Steps:

1. Enable WordPress audit logging (e.g., using WP Activity Log plugin).
2. Monitor web server access logs for patterns matching the endpoints.
3. Use the Sigma rule below to correlate events.

Indicators of Compromise (IOCs)

• URL Patterns:
  • /wp-json/rsvpmarker/v1/events
  • /wp-json/rsvpmarker/v1/attendees
  • /wp-admin/admin-ajax.php?action=rsvpmarker_get_events
• HTTP Response: JSON containing event data without authentication.
• User-Agent: Any standard browser UA (no specific pattern).
• Source IP: Any external IP (no specific attribution).

Detection Engineering

YARA Rule

rule CVE_2025_24600_RSVPMarker {
    meta:
        description = "Detects RSVPMarker plugin files with missing authorization"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-24600"
    strings:
        $func1 = "rsvpmaker_get_events" ascii wide nocase
        $func2 = "rsvpmaker_ajax_handler" ascii wide nocase
        $func3 = "current_user_can" ascii wide nocase
    condition:
        ($func1 or $func2) and not $func3
}

Sigma Rule

title: CVE-2025-24600 RSVPMarker Missing Authorization
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to RSVPMarker REST API endpoints
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - "/wp-json/rsvpmarker/v1/"
            - "action=rsvpmarker_"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin access from authenticated users
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-24600 RSVPMarker Missing Authorization Attempt";
    flow:to_server,established;
    content:"/wp-json/rsvpmarker/v1/"; http_uri;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:cve,2025-24600;
)

Remediation & Mitigation

Since no official patch exists, the following mitigations are recommended:

1. Disable the plugin immediately if not critical to operations.
2. Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to /wp-json/rsvpmarker/v1/* and admin-ajax.php with rsvpmarker_ actions.
3. Restrict access to the plugin's REST endpoints via .htaccess or server configuration:

   <IfModule mod_rewrite.c>
       RewriteEngine On
       RewriteCond %{REQUEST_URI} ^/wp-json/rsvpmarker/v1/ [NC]
       RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
       RewriteRule .* - [F,L]
   </IfModule>
   

4. Monitor for vendor updates and apply patches as soon as they become available.
5. Use a security plugin like Wordfence to add virtual patching for this vulnerability.

Valters IT
DevSecOps & Cyber Threat Intelligence