CVE-2025-31757

Executive Summary

CVE-2025-31757 is a Missing Authorization vulnerability in the WordPress plugin Free Woocommerce Product Table View (slug: free-product-table-for-woocommerce) by BinaryCarpenter. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data exposure or manipulation of product table views. The vulnerability affects all versions up to and including 1.78. As of this report, no official patch has been released, and no public exploit code or proof-of-concept (PoC) is available. The EPSS score is 0.0%, indicating low current exploitation activity, but the risk remains due to the plugin’s widespread use in WooCommerce environments.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress Plugin Directory. Since no patch is available, site administrators must consider removing or disabling the plugin until a fix is released. The lack of a patch also means that supply chain risk is elevated, as any site using this plugin is exposed to potential exploitation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: Low (C:L) – Limited unauthorized data access.
• Integrity Impact: Low (I:L) – Limited unauthorized modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for chaining with other vulnerabilities could elevate the risk.

Deep Dive & Mechanics

The vulnerability stems from a Missing Authorization check (CWE-862) in the plugin’s AJAX handlers or REST endpoints. The plugin likely exposes functions to render product tables without verifying that the requesting user has the necessary capabilities (e.g., edit_posts, manage_woocommerce). An unauthenticated attacker can send crafted HTTP requests to trigger these functions, potentially:

• Viewing product table data that should be restricted (e.g., draft/private products).
• Modifying table settings or configurations.
• Accessing sensitive WooCommerce data.

The plugin’s code likely uses wp_ajax_* and wp_ajax_nopriv_* hooks without proper capability checks, or it relies on nonces that are not validated against user roles.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve adding capability checks to all AJAX handlers. For example:

Vulnerable Code (hypothetical):

add_action('wp_ajax_get_product_table', 'handle_get_product_table');
add_action('wp_ajax_nopriv_get_product_table', 'handle_get_product_table');

function handle_get_product_table() {
    // No capability check
    $products = wc_get_products(array('status' => 'publish'));
    wp_send_json($products);
}

Patched Code (hypothetical):

add_action('wp_ajax_get_product_table', 'handle_get_product_table');
// Remove nopriv hook to restrict to authenticated users

function handle_get_product_table() {
    if (!current_user_can('edit_products')) {
        wp_die('Unauthorized', 403);
    }
    $products = wc_get_products(array('status' => 'publish'));
    wp_send_json($products);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit exists, a penetration tester would need to reverse-engineer the plugin. Steps:

1. Identify AJAX actions: Search the plugin source for wp_ajax_ and wp_ajax_nopriv_ hooks.
2. Craft requests: Use curl or Burp Suite to send requests to /wp-admin/admin-ajax.php with the action parameter.
3. Test for missing authorization: Attempt to access actions without authentication.

Example curl command:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  -d 'action=get_product_table&nonce=123' \
  -H 'User-Agent: Mozilla/5.0'

If the response returns product data without a valid nonce or authentication, the vulnerability is confirmed.

Blue Team (Detection & Hardening)

• Disable the plugin until a patch is released.
• Monitor logs for unusual AJAX requests to admin-ajax.php with unknown actions.
• Implement Web Application Firewall (WAF) rules to block requests to plugin-specific endpoints from unauthenticated users.
• Use a WordPress security plugin (e.g., Wordfence) to add virtual patching.

Indicators of Compromise (IOCs)

• File paths: /wp-content/plugins/free-product-table-for-woocommerce/
• AJAX actions: Any action prefixed with free_product_table_ or similar.
• HTTP requests: POST to /wp-admin/admin-ajax.php with action parameter containing plugin-specific strings.
• Log entries: admin-ajax.php requests from unauthenticated IPs with 200 responses returning JSON product data.

Detection Engineering

YARA Rule

rule Detect_Free_Product_Table_Plugin
{
    meta:
        description = "Detects the vulnerable Free Woocommerce Product Table View plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-31757"
    strings:
        $plugin_dir = "free-product-table-for-woocommerce"
        $php_class = "BinaryCarpenter\\FreeProductTable"
        $ajax_hook = "wp_ajax_nopriv_"
    condition:
        $plugin_dir or ($php_class and $ajax_hook)
}

Sigma Rule

title: CVE-2025-31757 - Missing Authorization in Free Woocommerce Product Table View
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects unauthenticated AJAX requests to the vulnerable plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action='
    condition: selection
falsepositives:
    - Legitimate plugin usage by authenticated users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-31757 - Free Product Table AJAX Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action="; http_client_body; pcre:"/action=(free_product_table|get_product_table)/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable and uninstall the plugin until a patch is released.
2. Virtual Patching: Use a WAF to block requests to admin-ajax.php with plugin-specific action parameters from unauthenticated users.
3. Monitor: Review server logs for exploitation attempts.
4. Update: Subscribe to BinaryCarpenter’s updates for a patched version.
5. Alternative: Consider replacing the plugin with a secure alternative (e.g., WooCommerce Product Table by Barn2).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert