CVE-2025-47628

Executive Summary

CVE-2025-47628 is a Missing Authorization vulnerability in the Quomodosoft QS Dark Mode WordPress plugin, affecting versions up to and including 3.0. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of plugin settings or data exposure. The vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx.

The CVSS score of 5.4 (Medium) reflects the low complexity and network-based attack vector, but the lack of required privileges and user interaction makes it a viable target for automated exploitation. The EPSS score of 0.0% indicates low current exploitation activity, but the absence of a patch increases long-term risk.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but has limited impact. However, in a WordPress multisite or shared hosting environment, the risk may be elevated.

Deep Dive & Mechanics

The vulnerability resides in the qs-dark-mode plugin's AJAX handlers or REST API endpoints. The plugin likely fails to perform proper capability checks (e.g., current_user_can('manage_options')) before executing sensitive actions such as saving settings, toggling dark mode for all users, or modifying user preferences.

Root Cause: The plugin uses wp_ajax_ and wp_ajax_nopriv_ hooks without verifying user roles. This allows unauthenticated users to call privileged functions.

Attack Vector: An attacker sends crafted HTTP requests to the WordPress installation, targeting the plugin's AJAX endpoints. For example:

POST /wp-admin/admin-ajax.php
action=qs_dark_mode_save_settings
data=...

Impact: An attacker could:

• Change the default dark mode state for all visitors.
• Exfiltrate plugin configuration (e.g., API keys if stored).
• Potentially inject malicious CSS/JS if the plugin stores user-supplied content without sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (<=3.0):

add_action('wp_ajax_nopriv_qs_dark_mode_save', 'qs_dark_mode_save_callback');
function qs_dark_mode_save_callback() {
    // No capability check
    update_option('qs_dark_mode_settings', $_POST['settings']);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_qs_dark_mode_save', 'qs_dark_mode_save_callback');
// Remove nopriv hook to require authentication
function qs_dark_mode_save_callback() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    check_ajax_referer('qs_dark_mode_nonce', 'nonce');
    update_option('qs_dark_mode_settings', $_POST['settings']);
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with QS Dark Mode <= 3.0 installed and activated.
• Network access to the target.

Exploitation Steps:

1. Identify the AJAX endpoint by inspecting the plugin's JavaScript or source code.
2. Send a crafted request to admin-ajax.php:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d "action=qs_dark_mode_save&settings[enabled]=1&settings[inject_css]=body{background:red}"

3. Verify the attack by checking if the dark mode is forced or CSS is injected.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action parameters containing qs_dark_mode.
• Look for requests from unauthenticated users to privileged actions.

Hunting:

• Search logs for POST /wp-admin/admin-ajax.php with action=qs_dark_mode_* and no nonce parameter.
• Check for unexpected changes to the qs_dark_mode_settings option in the database.

Indicators of Compromise (IOCs)

• Network:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=qs_dark_mode_* from unauthenticated sources.
  • Unusual settings parameters in POST data (e.g., inject_css, custom_js).

• Host:

  • Modified qs_dark_mode_settings option in wp_options table.
  • Unexpected files in /wp-content/plugins/qs-dark-mode/ (e.g., backdoors).

• Logs:

  • WordPress debug log entries showing qs_dark_mode_save_callback called without nonce.

Detection Engineering

YARA Rule

rule CVE_2025_47628_QS_Dark_Mode {
    meta:
        description = "Detects exploitation attempts for CVE-2025-47628 in QS Dark Mode plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47628"
    strings:
        $ajax_action = "qs_dark_mode_save" nocase
        $ajax_action2 = "qs_dark_mode_update" nocase
        $nopriv = "wp_ajax_nopriv_" nocase
        $settings = "settings[" nocase
    condition:
        any of ($ajax_action*) and $nopriv and $settings
}

Sigma Rule

title: CVE-2025-47628 QS Dark Mode Unauthenticated AJAX Access
id: 8a3f5c2e-7b1d-4f9a-8c6e-2d1a3b4c5d6e
status: experimental
description: Detects unauthenticated AJAX requests to QS Dark Mode endpoints
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=qs_dark_mode_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-47628 QS Dark Mode Unauthenticated AJAX Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=qs_dark_mode_"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=qs_dark_mode_* from unauthenticated users.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor must release a patched version that adds proper capability checks (current_user_can('manage_options')) and nonce verification.
• Users should update to the latest version once available.

Workaround:

• Add the following code to the theme's functions.php to block unauthenticated access:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX && !is_user_logged_in()) {
        $action = $_REQUEST['action'] ?? '';
        if (strpos($action, 'qs_dark_mode_') === 0) {
            wp_die('Unauthorized', 403);
        }
    }
});

Valters IT
Securing Digital Frontiers