CVE-2025-31887

Executive Summary

CVE-2025-31887 is a Missing Authorization vulnerability (CWE-862) in the MyBookProgress by Stormhill Media WordPress plugin, affecting versions up to and including 1.0.8. This flaw allows unauthenticated attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data exposure or manipulation. The vulnerability is classified as Medium Severity with a CVSS score of 4.3, and currently has no known public exploit or patch available. Given the WordPress ecosystem context, this issue is particularly concerning for sites using the plugin to track reading progress, as it may expose user-specific book progress data.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems. However, as a WordPress plugin, it is part of the broader supply chain for WordPress sites. Administrators should verify the plugin's integrity by checking checksums from the WordPress plugin directory and ensure no unauthorized modifications have been made. Since no patch is available, the only supply chain mitigation is to disable or remove the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The low EPSS score (0.0%) suggests that exploitation is not currently widespread, but the lack of a patch and the simplicity of the attack vector (no authentication required) make this a potential target for automated scanning.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the MyBookProgress plugin's REST API endpoints or AJAX handlers. The plugin likely exposes functions to retrieve or modify book progress data without verifying that the requesting user has the appropriate permissions. This could allow an unauthenticated attacker to:

• Read other users' reading progress (e.g., book titles, pages read, completion status).
• Potentially modify progress data if write operations are also unprotected.

The affected component is likely a WordPress REST API route or an admin-ajax action that fails to call current_user_can() or similar capability checks. Since the plugin version is <= 1.0.8, any site running this version is vulnerable.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern. A typical missing authorization vulnerability in WordPress plugins looks like:

Vulnerable Code (hypothetical):

add_action('wp_ajax_nopriv_mybookprogress_get_data', 'mybookprogress_get_data');
function mybookprogress_get_data() {
    // No capability check
    $user_id = $_GET['user_id'];
    $data = get_user_meta($user_id, 'mybookprogress', true);
    wp_send_json($data);
}

Patched Code (hypothetical):

add_action('wp_ajax_mybookprogress_get_data', 'mybookprogress_get_data');
add_action('wp_ajax_nopriv_mybookprogress_get_data', 'mybookprogress_get_data');
function mybookprogress_get_data() {
    if (!current_user_can('read')) {
        wp_die('Unauthorized');
    }
    $user_id = get_current_user_id();
    $data = get_user_meta($user_id, 'mybookprogress', true);
    wp_send_json($data);
}

The patch would add a capability check and restrict data access to the current user only.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with MyBookProgress plugin version <= 1.0.8 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns include:
   • /wp-admin/admin-ajax.php?action=mybookprogress_get_data&user_id=1
   • /wp-json/mybookprogress/v1/progress/1
2. Send a GET request to the endpoint with a target user ID.
3. If the endpoint returns data without authentication, the vulnerability is confirmed.

Example curl command:

curl -X GET "http://target-site.com/wp-admin/admin-ajax.php?action=mybookprogress_get_data&user_id=1"

Expected output: JSON object containing book progress data for user ID 1.

Blue Team

Detection:

• Monitor for unusual requests to admin-ajax.php or REST API endpoints associated with the plugin.
• Look for requests with action=mybookprogress_* parameters from unauthenticated users.
• Check for repeated attempts to enumerate user IDs via the vulnerable endpoint.

Hunting:

• Search web server logs for patterns like admin-ajax.php?action=mybookprogress or wp-json/mybookprogress/.
• Use the Sigma rule provided in Detection Engineering to identify exploitation attempts.

Containment:

• Immediately disable the plugin via wp-admin/plugins.php or by renaming the plugin directory.
• If disabling is not possible, block the vulnerable endpoints using a web application firewall (WAF) rule.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=mybookprogress_* parameters.
  • HTTP requests to /wp-json/mybookprogress/v1/* endpoints.
  • Unusual user ID enumeration in query parameters (e.g., user_id=1, user_id=2).

• File IOCs:

  • Plugin file: /wp-content/plugins/mybookprogress/mybookprogress.php (version <= 1.0.8)
  • Suspicious log entries in web server access logs.

• Behavioral IOCs:

  • Unauthenticated access to plugin-specific AJAX actions.
  • Multiple requests with sequential user IDs.

Detection Engineering

YARA Rule

rule CVE_2025_31887_MyBookProgress_Missing_Auth {
    meta:
        description = "Detects MyBookProgress plugin files vulnerable to CVE-2025-31887"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-31887"
        severity = "medium"
    strings:
        $vuln_func = "wp_ajax_nopriv_" nocase
        $plugin_slug = "mybookprogress" nocase
        $version_check = "Version: 1.0.8" nocase
    condition:
        $plugin_slug and $vuln_func and $version_check
}

Sigma Rule

title: CVE-2025-31887 MyBookProgress Missing Authorization Exploitation
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-31887 in MyBookProgress WordPress plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'action=mybookprogress_'
            - '/wp-json/mybookprogress/'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (if properly authorized)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-31887 MyBookProgress Missing Authorization Exploitation";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"action=mybookprogress_";
    http_uri;
    content:"/wp-json/mybookprogress/";
    http_uri;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:cve,2025-31887;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released. Navigate to wp-admin/plugins.php and deactivate "MyBookProgress by Stormhill Media".
2. If the plugin is critical, implement a WAF rule to block unauthenticated requests to the vulnerable endpoints:
   • Block requests containing action=mybookprogress_ in the query string.
   • Block requests to /wp-json/mybookprogress/ from unauthenticated users.

Long-term Remediation:

• Monitor the WordPress plugin repository for an official patch.
• Once patched, update to the latest version immediately.
• Conduct a security audit of all WordPress plugins to ensure proper authorization checks.

Workaround:

• If the plugin source code is accessible, manually add capability checks to the vulnerable functions (as shown in the patched code example). However, this is not recommended for non-developers.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI Assistant. For questions or further analysis, contact your security team.