CVE-2025-47486

Executive Summary

CVE-2025-47486 is a Missing Authorization vulnerability in the Responsive Plus WordPress plugin (slug: responsive-add-ons) developed by CyberChimps. The flaw allows unauthenticated attackers to access functionality that should be constrained by Access Control Lists (ACLs). This affects all versions from n/a through 3.1.9. With a CVSS score of 5.3 (Medium), the vulnerability primarily impacts confidentiality, as an attacker can potentially read sensitive data or perform unauthorized actions without proper authentication. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains for unpatched WordPress sites.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via manual upload are affected. No supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors forking or backporting fixes.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthenticated access to restricted functionality, but the impact is limited to low confidentiality loss. No integrity or availability impact.

Deep Dive & Mechanics

The vulnerability stems from missing capability checks in the responsive-add-ons plugin. WordPress plugins often use current_user_can() or similar functions to verify user permissions before executing sensitive actions. In this case, certain AJAX handlers or REST API endpoints lack these checks, allowing unauthenticated users to trigger functions that should require at least a subscriber-level role.

The affected functionality likely includes:

• Retrieving plugin settings or configuration data.
• Accessing logs or debug information.
• Triggering actions that modify non-critical data.

The exact endpoint is not publicly documented, but based on the CWE-862 classification, it involves a function that does not properly verify the user's capabilities before executing.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve adding capability checks. Below is an example of vulnerable code and its patched version.

Vulnerable Code (responsive-add-ons <= 3.1.9):

add_action('wp_ajax_nopriv_responsive_get_settings', 'responsive_get_settings');
function responsive_get_settings() {
    // No capability check
    $settings = get_option('responsive_plus_settings');
    wp_send_json($settings);
}

Patched Code (hypothetical):

add_action('wp_ajax_nopriv_responsive_get_settings', 'responsive_get_settings');
function responsive_get_settings() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $settings = get_option('responsive_plus_settings');
    wp_send_json($settings);
}

The patched version adds a current_user_can('manage_options') check, ensuring only administrators can access the settings.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Responsive Plus plugin version <= 3.1.9 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable endpoint. Based on the plugin's code, it may be an AJAX action like responsive_get_settings or responsive_export_data.
2. Send a direct HTTP request to the WordPress admin-ajax.php endpoint with the action parameter.
3. Example using curl:

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
        -d "action=responsive_get_settings"
   

4. If successful, the response will contain sensitive plugin data.

Note: No public exploit code exists; this is a theoretical approach.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions prefixed with responsive_ from unauthenticated users.
• Look for HTTP 200 responses to such requests without a prior login session.

Defense:

• Immediately disable or remove the Responsive Plus plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to admin-ajax.php with responsive_ actions.
• Use a WordPress security plugin to add additional capability checks.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=responsive_* parameters from unauthenticated IPs.
  • Response bodies containing plugin configuration data (e.g., API keys, settings).

• File IOCs:

  • Presence of the plugin directory: /wp-content/plugins/responsive-add-ons/
  • Version file: /wp-content/plugins/responsive-add-ons/readme.txt showing version <= 3.1.9

• Log IOCs:

  • WordPress debug log entries showing wp_ajax_nopriv_responsive_* actions being called.

Detection Engineering

YARA Rule

rule CVE_2025_47486_Responsive_Plus_Missing_Auth {
    meta:
        description = "Detects vulnerable Responsive Plus plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47486"
    strings:
        $vuln_func = "wp_ajax_nopriv_responsive_" ascii wide nocase
        $no_check = "current_user_can" ascii wide nocase
    condition:
        $vuln_func and not $no_check
}

Sigma Rule

title: CVE-2025-47486 - Unauthenticated AJAX Access to Responsive Plus
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated AJAX requests targeting Responsive Plus plugin actions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=responsive_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-47486 - Unauthenticated AJAX Access to Responsive Plus";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=responsive_"; http_client_body;
    nocase;
    sid:1000001;
    rev:1;
    reference:cve,2025-47486;
    metadata:author "Valters IT";
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the Responsive Plus plugin from all WordPress installations.
2. Monitor logs: Review web server and WordPress logs for any unauthorized access attempts.
3. Update: Check the WordPress plugin repository for any future updates. If none, consider switching to an alternative plugin.

Long-term Mitigation:

• Implement a Web Application Firewall (WAF) with rules to block unauthenticated AJAX requests.
• Use a WordPress security plugin that adds virtual patching for known vulnerabilities.
• Regularly audit all installed plugins for missing authorization checks.

Vendor Contact: CyberChimps has not responded to disclosure attempts. Users should consider this plugin abandoned and seek alternatives.

Valters IT