CVE-2025-26960

Executive Summary

CVE-2025-26960 is a Missing Authorization vulnerability in the WordPress plugin Small Package Quotes – Unishippers Edition by enituretechnology. This flaw allows unauthenticated attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access, modification, or privilege escalation. The vulnerability affects all versions up to and including 2.4.9. As of this report, no patch has been released by the vendor, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for unpatched WordPress installations.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the WordPress dashboard or via direct download are affected. No known supply chain compromise has been reported, but the lack of a patch means users must rely on alternative mitigations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The vulnerability is exploitable remotely without authentication, making it a medium-severity threat. While the impact is limited to low-level confidentiality, integrity, and availability loss, the lack of a patch elevates the operational risk.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the plugin's AJAX handlers or REST API endpoints. The plugin likely fails to verify user capabilities before executing sensitive actions, such as retrieving or modifying shipping quotes, configuration settings, or user data. Attackers can send crafted HTTP requests to trigger these actions without a valid session or token.

The affected component is the small-package-quotes-unishippers-edition plugin, which integrates with Unishippers for small package shipping quotes. The missing authorization allows attackers to:

• Access internal plugin settings.
• Modify shipping configurations.
• Retrieve sensitive business data (e.g., API keys, customer information).

No specific file or function has been publicly disclosed, but the vulnerability class (CWE-862) suggests improper use of current_user_can() or similar capability checks in WordPress.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve adding capability checks to all AJAX and REST endpoints. Below is an example of vulnerable vs. patched code.

Vulnerable Code (hypothetical):

add_action('wp_ajax_nopriv_get_quote', 'unishippers_get_quote');
function unishippers_get_quote() {
    // No capability check
    $data = $_POST['data'];
    // Process and return quote
    echo json_encode($result);
    wp_die();
}

Patched Code (hypothetical):

add_action('wp_ajax_nopriv_get_quote', 'unishippers_get_quote');
function unishippers_get_quote() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $data = $_POST['data'];
    // Process and return quote
    echo json_encode($result);
    wp_die();
}

Exploitation & Lab Setup

Red Team

Since no public exploit exists, a red team can craft a proof-of-concept by sending unauthenticated requests to the plugin's endpoints. Use the following steps:

1. Identify the plugin's AJAX actions (e.g., via source code or fuzzing).
2. Send a POST request to /wp-admin/admin-ajax.php with the action parameter.
3. Observe if the server returns data without authentication.

Example curl command:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=unishippers_get_quote&data=test"

If the response contains sensitive data or configuration, the vulnerability is confirmed.

Blue Team

To detect exploitation attempts, monitor for unusual requests to admin-ajax.php with plugin-specific actions. Look for patterns such as:

• Repeated requests from the same IP without a valid session cookie.
• Requests to actions that should require authentication (e.g., manage_options capability).
• Anomalous data in POST parameters (e.g., SQL injection attempts).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action parameters like unishippers_get_quote, unishippers_update_settings, etc.
  • Requests lacking Cookie headers or with invalid session tokens.
• File IOCs:
  • Modified plugin files in /wp-content/plugins/small-package-quotes-unishippers-edition/.
  • Unexpected log entries in WordPress debug logs.
• System IOCs:
  • Unauthorized changes to WordPress options or user roles.
  • New admin users created without proper authorization.

Detection Engineering

YARA Rule

rule CVE_2025_26960_WordPress_Plugin {
    meta:
        description = "Detects missing authorization in Small Package Quotes – Unishippers Edition plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-26960"
    strings:
        $vuln_func = "wp_ajax_nopriv_" nocase
        $plugin_path = "small-package-quotes-unishippers-edition" nocase
    condition:
        $vuln_func and $plugin_path
}

Sigma Rule

title: CVE-2025-26960 - Missing Authorization in Unishippers Plugin
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated requests to vulnerable plugin AJAX endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=unishippers_'
    condition: selection
falsepositives:
    - Legitimate plugin usage by authenticated users
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-26960 - Unishippers Plugin Missing Authorization Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=unishippers_"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Since no official patch exists, the following mitigations are recommended:

1. Disable the plugin immediately if not critical to business operations.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=unishippers_* parameters from unauthenticated users.
3. Apply a virtual patch using a security plugin (e.g., Wordfence) to add capability checks.
4. Monitor logs for exploitation attempts and block offending IPs.
5. Contact the vendor for an ETA on a patch and consider switching to an alternative shipping plugin.

Valters IT
DevSecOps & Cyber Threat Intelligence