CVE-2025-31758

Executive Summary

CVE-2025-31758 is a Missing Authorization vulnerability in the WordPress plugin Free WooCommerce Product Table View (slug: free-product-table-for-woocommerce) by BinaryCarpenter. This flaw allows unauthenticated attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data exposure or manipulation of product table views. The vulnerability affects all versions up to and including 1.78. As of this report, no official patch has been released, and no public exploit code is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains due to the lack of a patch.

Supply Chain & Package Security

This is a WordPress plugin hosted on the official WordPress Plugin Directory. Users who installed the plugin via the WordPress admin dashboard or directly from the repository are affected. The plugin is not distributed via NPM, PyPI, Go, or Ruby registries. Supply chain risk is moderate due to the unpatched state and the plugin's direct integration into WordPress sites.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated exploitation.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited data modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to low confidentiality and integrity loss. However, the lack of a patch increases the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability resides in the Missing Authorization (CWE-862) within the plugin's AJAX handlers or REST API endpoints. The plugin likely exposes functions to render product tables without properly verifying user capabilities or nonces. An attacker can craft HTTP requests to:

• Access product table data that should be restricted (e.g., hidden products, pricing, or metadata).
• Modify table settings or configurations if write endpoints are exposed.

The flaw is in the free-product-table-for-woocommerce plugin, which is a WordPress ecosystem component. The plugin's code likely uses wp_ajax_* or wp_ajax_nopriv_* hooks without capability checks, allowing unauthenticated users to trigger actions.

Root Cause: The plugin fails to call current_user_can() or check for a valid nonce before processing requests. This is a classic case of Insecure Direct Object Reference (IDOR) combined with missing authorization.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable pattern. The plugin likely has code similar to:

// Vulnerable code (example)
add_action('wp_ajax_nopriv_get_product_table', 'get_product_table_callback');
function get_product_table_callback() {
    // No capability check
    $product_id = $_POST['product_id'];
    // Process and return data
    echo json_encode(get_post_meta($product_id));
    wp_die();
}

A patched version would include:

// Patched code (example)
add_action('wp_ajax_nopriv_get_product_table', 'get_product_table_callback');
function get_product_table_callback() {
    // Check nonce and capability
    if (!wp_verify_nonce($_POST['_wpnonce'], 'product_table_nonce') || !current_user_can('edit_posts')) {
        wp_die('Unauthorized');
    }
    $product_id = intval($_POST['product_id']);
    echo json_encode(get_post_meta($product_id));
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with the vulnerable plugin installed (version <= 1.78).
• No authentication required.

Exploitation Steps:

1. Identify vulnerable endpoints: Use a web proxy (e.g., Burp Suite) to intercept AJAX requests from the plugin's frontend. Look for actions like get_product_table, update_table_settings, etc.

2. Craft a malicious request: Send a POST request to /wp-admin/admin-ajax.php with the action parameter.

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
     -d "action=get_product_table&product_id=123"
   

3. Extract data: If the endpoint returns sensitive product data (e.g., hidden products, pricing), the attacker can harvest it.

4. Modify data (if write endpoint exists): Attempt to change table settings or product visibility.

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
     -d "action=update_table_settings&show_hidden=1"
   

Note: No public exploit code is available; this is a theoretical exploitation based on the vulnerability description.

Blue Team (Detection & Hardening)

Detection:

• Monitor admin-ajax.php requests for unusual actions related to the plugin (e.g., get_product_table, update_table_settings).
• Look for requests without a valid _wpnonce parameter.
• Alert on high-frequency requests to AJAX endpoints from unauthenticated IPs.

Hardening:

• Immediate: Disable or uninstall the plugin until a patch is released.

• Workaround: Add a custom function to your theme's functions.php to block unauthenticated access to the plugin's AJAX actions:

  add_action('init', function() {
      if (defined('DOING_AJAX') && DOING_AJAX) {
          $action = $_REQUEST['action'] ?? '';
          $blocked_actions = ['get_product_table', 'update_table_settings'];
          if (in_array($action, $blocked_actions) && !is_user_logged_in()) {
              wp_die('Unauthorized');
          }
      }
  });
  

• Web Application Firewall (WAF): Create rules to block requests to admin-ajax.php with suspicious action parameters from unauthenticated users.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=get_product_table or similar.
  • Requests lacking a _wpnonce parameter.
  • Unusual product IDs in requests (e.g., sequential IDs, out-of-range values).

• File IOCs:

  • Plugin file: /wp-content/plugins/free-product-table-for-woocommerce/ (version <= 1.78).
  • Modified database entries in wp_postmeta for products (if write endpoint exploited).

• Log IOCs:

  • WordPress debug log entries showing admin-ajax.php calls with missing nonce errors.
  • Web server access logs with repeated admin-ajax.php requests from the same IP.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_31758_Plugin {
    meta:
        description = "Detects vulnerable Free WooCommerce Product Table View plugin files"
        author = "Valters IT"
        date = "2025-04-17"
        cve = "CVE-2025-31758"
    strings:
        $vuln_func = "wp_ajax_nopriv_" nocase
        $plugin_slug = "free-product-table-for-woocommerce" nocase
        $missing_check = "current_user_can" nocase
    condition:
        $plugin_slug and $vuln_func and not $missing_check
}

Sigma Rule

title: CVE-2025-31758 - Missing Authorization in Free WooCommerce Product Table View
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated AJAX requests to vulnerable plugin endpoints
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=get_product_table'
            - 'product_id='
    condition: selection
falsepositives:
    - Legitimate admin users (if logged in)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-31758 - Missing Authorization in Free WooCommerce Product Table View"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=get_product_table"; http_client_body; content:"product_id="; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Apply the workaround (see Blue Team section) to block unauthenticated AJAX requests.
3. Monitor logs for exploitation attempts.

Long-term Actions:

• Vendor Patch: Await an update from BinaryCarpenter. Check the WordPress Plugin Directory for version 1.79 or higher.
• Alternative Plugin: Consider replacing with a similar plugin that has proper authorization checks.
• Security Hardening: Implement a Web Application Firewall (WAF) with rules to block unauthenticated AJAX requests to known vulnerable actions.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact security@valters-it.com.