CVE-2025-30960

Executive Summary

CVE-2025-30960 is a critical Missing Authorization vulnerability (CWE-862) in the FS Poster WordPress plugin (by fs-code), affecting versions up to and including 6.5.8. This flaw allows unauthenticated attackers to bypass authorization checks, potentially leading to full compromise of the WordPress site, including data exfiltration, privilege escalation, and remote code execution. The vulnerability has a CVSS score of 8.3 (High) and currently has no known public exploit or patch. Given the plugin's widespread use for social media automation, this poses a significant supply chain risk to WordPress ecosystems.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Organizations using FS Poster must treat this as a supply chain risk, as the plugin has privileged access to the WordPress database and file system. No patched version is currently available, making it imperative to implement virtual patching or disable the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected asset.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full data modification possible.
• Availability (A): High (H) – Full denial of service possible.

Threat Level: Critical (8.3) – Immediate action required.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the FS Poster plugin's REST API endpoints or AJAX handlers. The plugin likely fails to verify user capabilities (e.g., manage_options or edit_posts) before executing sensitive operations such as:

• Modifying plugin settings
• Creating/editing/deleting social media accounts
• Triggering posts to external platforms
• Accessing stored credentials or tokens

An unauthenticated attacker can send crafted HTTP requests to these unprotected endpoints, bypassing WordPress's built-in capability checks. This can lead to:

• Privilege Escalation: Creating new admin users.
• Data Exfiltration: Stealing API keys, tokens, and user data.
• Remote Code Execution: Uploading malicious files or modifying plugin code.

The vulnerability is classified under CWE-862: Missing Authorization, which is distinct from authentication bypass – the attacker does not need to log in at all.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is inferred. The plugin likely uses a pattern similar to:

// VULNERABLE: No capability check
add_action('wp_ajax_nopriv_fs_poster_save_settings', 'fs_poster_save_settings');
function fs_poster_save_settings() {
    // Process and save settings without checking user capabilities
    update_option('fs_poster_settings', $_POST['settings']);
}

A patched version would include:

// PATCHED: Capability check added
add_action('wp_ajax_fs_poster_save_settings', 'fs_poster_save_settings');
function fs_poster_save_settings() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    // Process and save settings
    update_option('fs_poster_settings', $_POST['settings']);
}

The key difference is the removal of nopriv (allowing unauthenticated access) and the addition of current_user_can() checks.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress site with FS Poster <= 6.5.8 installed and activated.
• No authentication required.

Exploitation Steps:

1. Enumerate vulnerable endpoints – Use a tool like Burp Suite or curl to discover unprotected AJAX actions. Common patterns include:

   • wp-admin/admin-ajax.php?action=fs_poster_*
   • /wp-json/fs-poster/v1/*

2. Craft a malicious request – Example to create a new admin user:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=fs_poster_create_user&username=attacker&email=attacker@evil.com&role=administrator"

3. Verify exploitation – Log in with the created credentials and confirm admin access.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Defensive)

Detection & Response:

1. Monitor for unusual AJAX requests – Look for admin-ajax.php requests with action parameters starting with fs_poster_ from unauthenticated sources.

2. Check for new admin users – Run SQL query:

SELECT * FROM wp_users WHERE user_registered > NOW() - INTERVAL 1 DAY;

3. Review plugin file integrity – Compare plugin files against the official repository checksums.

4. Implement virtual patching – Use a WAF rule to block unauthenticated requests to FS Poster endpoints:

# Nginx virtual patch
location ~* /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^fs_poster_") {
        return 403;
    }
}

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /wp-admin/admin-ajax.php with action=fs_poster_* parameters from unauthenticated IPs.
• Unusual outbound connections to social media APIs (Facebook, Twitter, etc.) from the WordPress server.

File IOCs:

• Modified plugin files in /wp-content/plugins/fs-poster/ with unexpected timestamps.
• New files in /wp-content/uploads/ with executable extensions (.php, .phtml).

System IOCs:

• New WordPress admin users created without legitimate authorization.
• Unexpected changes to the wp_options table, specifically fs_poster_* options.

Detection Engineering

YARA Rule

rule CVE_2025_30960_FS_Poster_Missing_Auth {
    meta:
        description = "Detects FS Poster plugin files vulnerable to CVE-2025-30960"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-30960"
        hash = "unknown"
    strings:
        $vuln_pattern = "add_action('wp_ajax_nopriv_fs_poster_" ascii wide nocase
        $vuln_pattern2 = "add_action('wp_ajax_nopriv_fs_poster" ascii wide nocase
        $safe_pattern = "current_user_can(" ascii wide nocase
    condition:
        ($vuln_pattern or $vuln_pattern2) and not $safe_pattern
}

Sigma Rule

title: CVE-2025-30960 - FS Poster Missing Authorization Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated requests to FS Poster AJAX endpoints
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30960
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=fs_poster_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin actions (if authenticated)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-30960 - FS Poster Missing Authorization Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=fs_poster_"; http_client_body;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-30960;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete FS Poster until a patched version is released.
2. Implement virtual patching – Use WAF rules to block unauthenticated access to FS Poster endpoints.
3. Audit user accounts – Remove any unauthorized admin users created during exploitation.

Long-term Fix:

• Monitor the FS Poster plugin page for a security update (version > 6.5.8).
• Apply the patch as soon as it becomes available.
• Consider replacing the plugin with an alternative that follows secure coding practices.

Compensating Controls:

• Restrict access to /wp-admin/ using IP whitelisting or VPN.
• Enable WordPress security plugins (e.g., Wordfence, Sucuri) with virtual patching capabilities.
• Regularly audit plugin code for missing authorization checks.

Valters IT – DevSecOps & Cyber Threat Intelligence Report