CVE-2025-32255

Executive Summary

CVE-2025-32255 is an Exposure of Sensitive System Information vulnerability affecting the ERA404 StaffList plugin (WordPress ecosystem). The flaw allows an unauthenticated attacker to retrieve embedded sensitive data from the application, such as database credentials, API keys, or internal configuration details. With a CVSS score of 5.3 (Medium), the vulnerability is remotely exploitable without authentication or user interaction. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains for exposed instances.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for any unauthorized modifications. No official patch exists, so manual mitigation is required.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited sensitive data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No service disruption.

Threat Level: Medium. The vulnerability is easy to exploit but only exposes system information, not full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the StaffList plugin’s handling of AJAX requests or REST endpoints that return system configuration data. The plugin fails to properly restrict access to sensitive information, such as database credentials, file paths, or internal server variables. An attacker can send a crafted HTTP request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=stafflist_get_config) to retrieve this data.

The root cause is a missing authorization check in the plugin’s code. The function responsible for returning configuration data does not verify the user’s capabilities or nonce, allowing unauthenticated access.

Vulnerable vs. Patched Code

Vulnerable Code (StaffList <= 3.2.7):

add_action('wp_ajax_nopriv_stafflist_get_config', 'stafflist_get_config');
function stafflist_get_config() {
    // No capability check
    $config = get_option('stafflist_settings');
    wp_send_json($config);
}

Patched Code (Hypothetical Fix):

add_action('wp_ajax_stafflist_get_config', 'stafflist_get_config');
function stafflist_get_config() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $config = get_option('stafflist_settings');
    wp_send_json($config);
}

The patched version restricts access to authenticated users with manage_options capability and removes the nopriv hook to prevent unauthenticated access.

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify WordPress sites using StaffList plugin via Shodan dorks or Google dorking.
2. Exploit: Send a GET request to the vulnerable endpoint:

   curl -X GET "http://target.com/wp-admin/admin-ajax.php?action=stafflist_get_config"
   

3. Data Extraction: Parse the JSON response for sensitive data (e.g., database host, username, password, API keys).

Blue Team

1. Detection: Monitor for requests to /wp-admin/admin-ajax.php with action=stafflist_get_config from unauthenticated sources.
2. Honeypot: Deploy a fake StaffList endpoint that logs attacker IPs and returns decoy data.
3. Lab Setup:
   • Install WordPress with StaffList plugin version 3.2.7.
   • Configure a test database with dummy credentials.
   • Use Burp Suite or curl to simulate the exploit.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with parameter action=stafflist_get_config.
  • Outbound connections from the server to unknown IPs after data exfiltration.
• File IOCs:
  • Modified stafflist.php or stafflist-config.php files.
  • Unexpected files in /wp-content/uploads/ or /wp-content/plugins/stafflist/.
• Log IOCs:
  • Repeated 200 responses to /wp-admin/admin-ajax.php from the same IP.
  • Error logs showing stafflist_get_config function calls.

Detection Engineering

YARA Rule

rule CVE_2025_32255_StaffList_InfoLeak {
    meta:
        description = "Detects StaffList plugin files vulnerable to CVE-2025-32255"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-32255"
    strings:
        $vuln_func = "stafflist_get_config" nocase
        $nopriv_hook = "wp_ajax_nopriv_stafflist_get_config" nocase
    condition:
        $vuln_func and $nopriv_hook
}

Sigma Rule

title: CVE-2025-32255 StaffList Information Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to StaffList configuration endpoint
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=stafflist_get_config'
    condition: selection
falsepositives:
    - Legitimate admin requests (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-32255 StaffList Information Disclosure Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=stafflist_get_config"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Actions:
   • Disable the StaffList plugin until a patch is released.
   • Remove the vulnerable AJAX action by adding a custom function to functions.php:

     remove_action('wp_ajax_nopriv_stafflist_get_config', 'stafflist_get_config');
     

   • Restrict access to /wp-admin/admin-ajax.php via .htaccess:

     <Files "admin-ajax.php">
         Require all denied
         Require ip 127.0.0.1
     </Files>
     

2. Long-term Fix:
   • Contact ERA404 for an official patch.
   • Implement a Web Application Firewall (WAF) rule to block requests containing action=stafflist_get_config.
3. Monitoring:
   • Review server logs for exploitation attempts.
   • Rotate any exposed credentials immediately.

Valters IT