CVE-2025-30974

Executive Summary

CVE-2025-30974 is a Missing Authorization vulnerability in the Post Grid Master WordPress plugin by Akhtarujjaman Shuvo. The flaw resides in the ajax-filter-posts functionality, allowing unauthenticated attackers to exploit incorrectly configured access control security levels. This can lead to unauthorized data exposure or manipulation of post grid filters. The vulnerability affects all versions up to and including 3.4.17. No official patch has been confirmed at this time.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Post Grid Master plugin. It is not related to NPM, PyPI, Go, or Ruby packages. The risk is primarily to WordPress sites using this plugin, where an attacker can bypass authorization checks to access or modify post filter data.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The low EPSS score (0.0%) suggests limited active exploitation, but the missing authorization flaw can be chained with other vulnerabilities for greater impact.

Deep Dive & Mechanics

The vulnerability exists in the ajax-filter-posts action handler of the Post Grid Master plugin. The plugin fails to perform proper capability checks before processing AJAX requests. An attacker can send a crafted HTTP POST request to the WordPress admin-ajax.php endpoint with the action parameter set to ajax-filter-posts and manipulate filter parameters to access or modify post data without authentication.

The core issue is that the plugin relies on client-side or insufficient server-side authorization, allowing any unauthenticated user to trigger the AJAX callback. This can lead to:

• Unauthorized access to private or draft posts.
• Manipulation of filter queries to expose hidden content.
• Potential information disclosure about site structure and post metadata.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.4.17): The AJAX handler likely lacks a current_user_can() check or similar authorization guard.

add_action('wp_ajax_ajax-filter-posts', 'handle_filter_posts');
add_action('wp_ajax_nopriv_ajax-filter-posts', 'handle_filter_posts'); // Missing auth check

function handle_filter_posts() {
    // Process filter parameters without checking user capabilities
    $args = $_POST['filter_args'];
    $query = new WP_Query($args);
    // Output results
}

Patched Code (Hypothetical): A proper capability check should be added before processing the request.

add_action('wp_ajax_ajax-filter-posts', 'handle_filter_posts');
// Remove nopriv action to require authentication

function handle_filter_posts() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    // Process filter parameters
    $args = $_POST['filter_args'];
    $query = new WP_Query($args);
    // Output results
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Post Grid Master plugin <= 3.4.17.
• No authentication required.

Exploitation Steps:

1. Identify the target WordPress site and confirm the plugin version.
2. Send a crafted POST request to wp-admin/admin-ajax.php with the following parameters:
   • action: ajax-filter-posts
   • filter_args[post_type]: any
   • filter_args[post_status]: publish,private,draft
   • filter_args[posts_per_page]: 100

Example cURL command:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -d "action=ajax-filter-posts&filter_args[post_type]=any&filter_args[post_status]=publish,private,draft&filter_args[posts_per_page]=100"

Expected Outcome: The response will contain post data including private/draft posts if the filter is not restricted.

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action=ajax-filter-posts from unauthenticated users.
• Look for requests with filter_args parameters containing sensitive values like post_status=private or post_status=draft.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri_path="/wp-admin/admin-ajax.php" AND form_data.action="ajax-filter-posts"
| eval is_auth=if(form_data.cookie="*wordpress_logged_in*", "authenticated", "unauthenticated")
| where is_auth="unauthenticated"
| stats count by src_ip, uri, form_data

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=ajax-filter-posts from unauthenticated sources.
  • Unusual filter_args parameters in POST body (e.g., post_status=private).
• File IOCs:
  • Plugin file: /wp-content/plugins/ajax-filter-posts/ajax-filter-posts.php (or similar path).
  • Version file: /wp-content/plugins/ajax-filter-posts/readme.txt showing version <= 3.4.17.
• Log IOCs:
  • Web server logs showing 200 responses to admin-ajax.php with action=ajax-filter-posts from IPs not associated with logged-in users.

Detection Engineering

YARA Rule

rule CVE_2025_30974_Post_Grid_Master {
    meta:
        description = "Detects vulnerable Post Grid Master plugin files"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-30974"
    strings:
        $vuln_func = "wp_ajax_nopriv_ajax-filter-posts" nocase
        $vuln_handler = "handle_filter_posts" nocase
    condition:
        $vuln_func and $vuln_handler
}

Sigma Rule

title: CVE-2025-30974 - Post Grid Master Missing Authorization
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated AJAX requests to Post Grid Master filter endpoint
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-post: '*action=ajax-filter-posts*'
    condition: selection
falsepositives:
    - Legitimate authenticated users (check for session cookie)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-30974 - Post Grid Master Missing Authorization Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=ajax-filter-posts"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to admin-ajax.php with action=ajax-filter-posts.
3. Restrict access to admin-ajax.php via .htaccess or server config for unauthenticated users.

Long-term Fix:

• Apply the vendor patch when available (check plugin update page).
• If patching manually, add current_user_can('edit_posts') check in the AJAX handler.
• Monitor the plugin's changelog for version 3.4.18 or higher.

Workaround:

• Add the following to your theme's functions.php to block unauthenticated access:

add_action('wp_ajax_nopriv_ajax-filter-posts', function() {
    wp_die('Unauthorized', 403);
}, 1);

Valters IT
Securing Digital Frontiers