CVE-2025-30802

Executive Summary

CVE-2025-30802 is a medium-severity information disclosure vulnerability affecting the WordPress plugin Our Team Members by WPBean, versions up to and including 2.2. The flaw allows an unauthenticated attacker to access sensitive system information, such as internal file paths, database error messages, or configuration details, through an unauthorized control sphere. This exposure can aid in reconnaissance for further attacks. The vulnerability has a CVSS score of 4.3 (Medium) and currently has no known public exploit or patch.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and is installed directly by site administrators. No known supply chain compromise (e.g., malicious commits, backdoored packages) has been reported. However, the lack of a patch from the vendor increases the risk for all users of the affected versions.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions or race conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – Limited information disclosure.
• Integrity (I): None – No data modification possible.
• Availability (A): None – No denial of service.

Threat Level: Medium. While the direct impact is limited to information disclosure, the exposed data can be leveraged for targeted attacks, such as path traversal or SQL injection.

Deep Dive & Mechanics

The vulnerability stems from improper access controls in the plugin's REST API endpoints or AJAX handlers. The plugin exposes sensitive system information (e.g., WP_DEBUG logs, file paths, database errors) to unauthenticated users. This is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Root Cause Analysis: The plugin likely registers a REST API route or an AJAX action that returns debug or configuration data without checking user capabilities. For example, a function like get_team_member_debug_info() might be hooked to wp_ajax_nopriv_* (allowing unauthenticated access) instead of wp_ajax_* (requiring authentication).

Attack Vector: An attacker sends a crafted HTTP request to the vulnerable endpoint, e.g.:

GET /wp-json/our-team-members/v1/debug HTTP/1.1
Host: target-site.com

The server responds with sensitive data such as ABSPATH, database credentials, or PHP error logs.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. Below is a hypothetical vulnerable code snippet and a recommended fix.

Vulnerable Code (our-team-members.php):

add_action( 'rest_api_init', function () {
    register_rest_route( 'our-team-members/v1', '/debug', array(
        'methods' => 'GET',
        'callback' => 'otm_debug_info',
        'permission_callback' => '__return_true' // Vulnerable: allows all users
    ));
});

function otm_debug_info() {
    return new WP_REST_Response( array(
        'wp_debug' => defined('WP_DEBUG') ? WP_DEBUG : false,
        'abspath' => ABSPATH,
        'php_errors' => ini_get('error_log')
    ), 200 );
}

Patched Code (Recommended):

add_action( 'rest_api_init', function () {
    register_rest_route( 'our-team-members/v1', '/debug', array(
        'methods' => 'GET',
        'callback' => 'otm_debug_info',
        'permission_callback' => function() {
            return current_user_can( 'manage_options' ); // Only admins
        }
    ));
});

function otm_debug_info() {
    if ( ! current_user_can( 'manage_options' ) ) {
        return new WP_Error( 'rest_forbidden', 'Access denied', array( 'status' => 403 ) );
    }
    // ... rest of function
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Our Team Members plugin <= 2.2.
• No authentication required.

Steps:

1. Identify the vulnerable endpoint. Common patterns include /wp-json/our-team-members/v1/ or /wp-admin/admin-ajax.php?action=otm_debug.
2. Send a GET request to the endpoint:

   curl -v "http://target-site.com/wp-json/our-team-members/v1/debug"
   

3. Parse the response for sensitive data (e.g., ABSPATH, WP_DEBUG status, error log paths).

Expected Output:

{
  "wp_debug": true,
  "abspath": "/var/www/html/",
  "php_errors": "/var/log/php_errors.log"
}

Blue Team (Detection & Response)

Detection:

• Monitor for unusual requests to /wp-json/our-team-members/v1/ or admin-ajax.php?action=otm_* from unauthenticated IPs.
• Look for responses containing ABSPATH, WP_DEBUG, or error_log in the body.

Response:

1. Immediately disable the plugin if no patch is available.
2. Review server logs for any data exfiltration.
3. Rotate any exposed credentials (e.g., database passwords if disclosed).
4. Implement a Web Application Firewall (WAF) rule to block the vulnerable endpoint.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-json/our-team-members/v1/debug or similar.
  • User-Agent strings commonly used by scanners (e.g., curl, python-requests).
• File IOCs:
  • Plugin file: /wp-content/plugins/our-team-members/our-team-members.php (version <= 2.2).
• Log IOCs:
  • Access logs showing 200 responses to the vulnerable endpoint from unknown IPs.
  • Error logs containing ABSPATH or WP_DEBUG in the response body.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_30802_InfoDisclosure {
    meta:
        description = "Detects attempts to exploit CVE-2025-30802 in Our Team Members plugin"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-30802"
    strings:
        $endpoint1 = "/wp-json/our-team-members/v1/debug"
        $endpoint2 = "action=otm_debug"
        $sensitive1 = "ABSPATH"
        $sensitive2 = "WP_DEBUG"
        $sensitive3 = "error_log"
    condition:
        any of ($endpoint*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2025-30802 - Our Team Members Information Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to the vulnerable endpoint of Our Team Members plugin
author: Valters IT
date: 2025/04/17
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - '/wp-json/our-team-members/v1/debug'
            - 'action=otm_debug'
    condition: selection
falsepositives:
    - Legitimate admin debugging (rare)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-30802 - Our Team Members Information Disclosure Attempt";
    flow:to_server,established;
    content:"/wp-json/our-team-members/v1/debug"; http_uri;
    content:"GET"; http_method;
    sid:10000001;
    rev:1;
    reference:cve,2025-30802;
    classtype:attempted-recon;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by WPBean.
2. Implement a WAF rule to block requests to /wp-json/our-team-members/v1/* and admin-ajax.php?action=otm_* from unauthenticated users.
3. Review server logs for any signs of exploitation.

Long-Term Fix:

• Monitor the WordPress plugin repository for an official update.
• Apply the recommended code fix (see Vulnerable vs. Patched Code section) if you have development resources.
• Consider replacing the plugin with an alternative that is actively maintained.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.