CVE-2025-30990

Executive Summary

CVE-2025-30990 is a Missing Authorization vulnerability in the ThemeHunk Mega Menu Plus WordPress plugin, affecting versions up to and including 1.2.0. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of menu configurations or other restricted actions. The vulnerability is classified as a WordPress ecosystem issue, specifically within the plugin's access control mechanisms. No public proof-of-concept (PoC) or patch details are currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is Medium due to the low complexity and no required privileges, but the impact is limited to low integrity changes.

Deep Dive & Mechanics

The vulnerability stems from a Missing Authorization check (CWE-862) in the themehunk-megamenu-plus plugin. The plugin likely exposes AJAX actions or REST API endpoints that perform sensitive operations (e.g., saving menu settings, modifying menu items) without verifying the user's capabilities. An unauthenticated attacker can send crafted HTTP requests to these endpoints, bypassing access controls.

The affected code is likely in files such as ajax-handler.php or class-mega-menu.php, where functions like save_menu_settings() or update_menu_item() are registered without a current_user_can() check. The vulnerability is present in all versions up to 1.2.0.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example):

add_action('wp_ajax_nopriv_megamenu_save_settings', 'megamenu_save_settings');
function megamenu_save_settings() {
    // Missing authorization check
    update_option('megamenu_settings', $_POST['settings']);
    wp_die();
}

Patched Code (hypothetical example):

add_action('wp_ajax_megamenu_save_settings', 'megamenu_save_settings');
function megamenu_save_settings() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    update_option('megamenu_settings', $_POST['settings']);
    wp_die();
}

The patch adds a capability check (current_user_can('manage_options')) and removes the nopriv hook to prevent unauthenticated access.

Exploitation & Lab Setup

Red Team

1. Setup: Install WordPress with ThemeHunk Mega Menu Plus <= 1.2.0 on a local server.
2. Recon: Identify AJAX actions by inspecting the plugin's JavaScript files (e.g., admin.js). Look for actions like megamenu_save_settings or megamenu_update_item.
3. Exploit: Send a crafted POST request to wp-admin/admin-ajax.php with the action parameter and malicious payload.

   curl -X POST http://target/wp-admin/admin-ajax.php \
     -d "action=megamenu_save_settings&settings=malicious_value"
   

4. Verify: Check if the settings were modified without authentication.

Blue Team

1. Detection: Monitor wp-admin/admin-ajax.php requests for unknown actions or missing nonce parameters.
2. Logging: Enable WordPress debug logging (WP_DEBUG_LOG) to capture unauthorized AJAX calls.
3. Mitigation: Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with suspicious action names.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action parameters like megamenu_save_settings, megamenu_update_item, or similar.
• File: Modified wp_options table entries with megamenu_ prefix.
• Log: WordPress debug log entries showing wp_ajax_nopriv_* hooks being triggered.

Detection Engineering

YARA Rule

rule Detect_ThemeHunk_MegaMenu_Missing_Auth {
    meta:
        description = "Detects vulnerable ThemeHunk Mega Menu Plus plugin files"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-30990"
    strings:
        $ajax_hook = /add_action\s*\(\s*['\"]wp_ajax_nopriv_megamenu_/
        $missing_check = /function\s+megamenu_\w+\s*\(\)\s*\{[^}]*?(?!current_user_can)/
    condition:
        $ajax_hook and $missing_check
}

Sigma Rule

title: Unauthenticated AJAX Request to ThemeHunk Mega Menu
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated AJAX requests targeting ThemeHunk Mega Menu Plus plugin
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query:
            - '*action=megamenu_*'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-30990 - Unauthenticated AJAX to ThemeHunk Mega Menu";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=megamenu_"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the ThemeHunk Mega Menu Plus plugin until a patch is available.
2. Short-term: Implement a WAF rule to block requests to admin-ajax.php with action=megamenu_* parameters from unauthenticated users.
3. Long-term: Monitor the vendor's website for a patched version (>= 1.2.1) and update immediately. Apply the principle of least privilege to all WordPress plugins.

Valters IT
Securing Digital Frontiers