CVE-2025-3880

Executive Summary

CVE-2025-3880 is a medium-severity vulnerability affecting the Poll, Survey & Quiz Maker Plugin by Opinion Stage for WordPress, up to and including version 19.9.0. The flaw stems from a misconfigured capability check on several functions, allowing authenticated attackers with Contributor-level access or higher to modify the plugin’s account connection email address and disconnect the plugin from its service. While previously created content remains displayed and functional, this unauthorized modification can disrupt administrative control and potentially lead to further account takeover scenarios.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The CVSS score is 4.3 (Medium), with a low EPSS probability of exploitation (0.0%). No public proof-of-concept (PoC) or exploit code is currently available, but the risk is elevated due to the low privilege requirement (Contributor) and the potential for lateral movement within the WordPress admin environment.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a WordPress plugin issue. The plugin is distributed via the WordPress plugin repository and can be updated through the WordPress admin dashboard. No supply chain compromise has been identified.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered Medium due to the low authentication requirement and the ability to modify critical plugin settings. However, the lack of public exploits and low EPSS score reduce immediate urgency.

Deep Dive & Mechanics

The vulnerability resides in the plugin’s AJAX handlers that manage the connection to the Opinion Stage service. The functions responsible for updating the account email and disconnecting the plugin lack proper capability checks. In WordPress, Contributor-level users typically have limited permissions (e.g., can write and edit their own posts but cannot modify plugins or settings). However, due to the misconfigured capability check, these users can call the vulnerable AJAX endpoints.

The affected functions likely include:

• update_account_email()
• disconnect_plugin()

These functions are registered via wp_ajax_ hooks but do not verify that the current user has the manage_options or administrator capability. Instead, they may only check for edit_posts or similar, which Contributor-level users possess.

An attacker can:

1. Authenticate as a Contributor.
2. Send a crafted AJAX request to change the email address associated with the Opinion Stage account.
3. Disconnect the plugin, breaking the link between the WordPress site and the Opinion Stage service.

While existing polls and surveys remain visible, the site owner loses the ability to manage them through the plugin’s admin interface, potentially leading to data integrity issues.

Vulnerable vs. Patched Code

Vulnerable Code (<= 19.9.0):

add_action('wp_ajax_opinionstage_update_email', 'opinionstage_update_email');
function opinionstage_update_email() {
    // Missing capability check
    $email = sanitize_email($_POST['email']);
    update_option('opinionstage_email', $email);
    wp_die();
}

add_action('wp_ajax_opinionstage_disconnect', 'opinionstage_disconnect');
function opinionstage_disconnect() {
    // Missing capability check
    delete_option('opinionstage_connected');
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_opinionstage_update_email', 'opinionstage_update_email');
function opinionstage_update_email() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $email = sanitize_email($_POST['email']);
    update_option('opinionstage_email', $email);
    wp_die();
}

add_action('wp_ajax_opinionstage_disconnect', 'opinionstage_disconnect');
function opinionstage_disconnect() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    delete_option('opinionstage_connected');
    wp_die();
}

The patch adds current_user_can('manage_options') checks to ensure only administrators can perform these actions.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the vulnerable plugin (<= 19.9.0).
• A Contributor-level account (username/password).

Exploitation Steps:

1. Authenticate as a Contributor user.
2. Obtain a nonce (if required) by inspecting the plugin’s JavaScript or by making a GET request to the admin page.
3. Send a crafted AJAX request to change the email:

   curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
   -d 'action=opinionstage_update_email&email=attacker@evil.com' \
   --cookie 'wordpress_logged_in_...=...'
   

4. Disconnect the plugin:

   curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
   -d 'action=opinionstage_disconnect' \
   --cookie 'wordpress_logged_in_...=...'
   

Expected Outcome: The plugin’s email is changed, and the connection is severed. The site owner loses administrative control.

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with actions opinionstage_update_email or opinionstage_disconnect from non-admin users.
• Alert on changes to the opinionstage_email or opinionstage_connected options in the database.

Mitigation:

• Immediately update the plugin to a patched version (if available) or apply a temporary workaround by adding capability checks via a custom plugin or theme functions.php:

  add_action('wp_ajax_opinionstage_update_email', function() {
      if (!current_user_can('manage_options')) {
          wp_die('Unauthorized');
      }
  }, 1);
  

• Restrict Contributor-level accounts to only necessary permissions.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/poll-survey-quiz-maker/ (entire plugin directory)
• Database Option: opinionstage_email changed to an unknown email
• Database Option: opinionstage_connected set to empty or false
• Log Entry: AJAX requests to admin-ajax.php with action=opinionstage_update_email or action=opinionstage_disconnect from non-admin IPs
• User Agent: Any standard browser or curl

Detection Engineering

YARA Rule

rule CVE_2025_3880_OpinionStage_Plugin {
    meta:
        description = "Detects vulnerable Poll, Survey & Quiz Maker Plugin by Opinion Stage"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-3880"
    strings:
        $func1 = "opinionstage_update_email"
        $func2 = "opinionstage_disconnect"
        $vuln_check = "add_action('wp_ajax_opinionstage"
    condition:
        all of ($func*) and #vuln_check > 0
}

Sigma Rule

title: CVE-2025-3880 - Unauthorized Plugin Modification
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects AJAX requests to modify Opinion Stage plugin settings by non-admin users
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "action=opinionstage_update_email"
            - "action=opinionstage_disconnect"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-3880 - Opinion Stage Plugin Unauthorized Modification";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=opinionstage_update_email"; http_client_body;
    sid:1000001;
    rev:1;
    metadata:created_at 2025-04-01, cve CVE-2025-3880;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to the latest version (if a patch is released). Check the WordPress plugin repository for updates.
2. Apply a temporary workaround by adding capability checks via a custom plugin or theme functions.php as shown in the Blue Team section.
3. Review user roles and ensure Contributor-level accounts are not granted unnecessary permissions.

Long-term Measures:

• Implement a Web Application Firewall (WAF) rule to block AJAX requests to admin-ajax.php with suspicious actions from non-admin users.
• Regularly audit WordPress plugins for security updates.
• Enforce the principle of least privilege for all user roles.

Valters IT
Securing WordPress ecosystems through proactive threat intelligence.