CVE-2025-49906

Executive Summary

CVE-2025-49906 is a Missing Authorization vulnerability in the WordPress plugin WPComplete by StellarWP. This flaw allows an unauthenticated attacker to access functionality that should be constrained by Access Control Lists (ACLs). The vulnerability affects all versions up to and including 2.9.5.3. With a CVSS score of 5.3 (Medium), the primary impact is unauthorized information disclosure, as the attacker can bypass authorization checks to read sensitive data or trigger privileged actions without proper credentials. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository and commercial channels. Users who have installed WPComplete from any source are at risk. Since no patch exists, the supply chain risk is elevated—users must rely on custom mitigations or disable the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The low EPSS score (0.0%) suggests active exploitation is not widespread, but the lack of a patch makes it a ticking time bomb for unmitigated installations.

Deep Dive & Mechanics

The vulnerability stems from improper authorization checks in the WPComplete plugin’s AJAX handlers or REST API endpoints. The plugin likely fails to verify user capabilities (e.g., manage_options, edit_posts) before executing sensitive functions. An attacker can craft HTTP requests to endpoints that should require administrative privileges, bypassing the ACLs due to missing current_user_can() checks or similar WordPress authorization functions.

Root Cause: The plugin does not enforce capability checks on certain actions, allowing any unauthenticated user to invoke them. This is a classic CWE-862 (Missing Authorization) flaw.

Attack Vector: An attacker sends a crafted HTTP request (e.g., POST to /wp-admin/admin-ajax.php with a specific action parameter) that triggers a privileged function without authentication.

Impact: Unauthorized access to functionality such as viewing completion data, modifying settings, or triggering internal processes. The CVSS confidentiality impact is Low, but depending on the exposed functionality, it could lead to further privilege escalation or data leakage.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable version likely contains code similar to:

// Vulnerable: No capability check
add_action('wp_ajax_nopriv_wpcomplete_export_data', 'wpcomplete_export_data');
function wpcomplete_export_data() {
    // Process export without checking user permissions
    $data = get_option('wpcomplete_data');
    echo json_encode($data);
    wp_die();
}

A patched version would include:

// Patched: Capability check added
add_action('wp_ajax_nopriv_wpcomplete_export_data', 'wpcomplete_export_data');
function wpcomplete_export_data() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $data = get_option('wpcomplete_data');
    echo json_encode($data);
    wp_die();
}

The key difference is the addition of current_user_can('manage_options') to restrict access to administrators.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install WordPress 6.x on a local server (e.g., XAMPP, Docker).
2. Install WPComplete version 2.9.5.3 from the plugin repository.
3. Ensure the plugin is activated.

Exploitation Steps:

1. Identify the vulnerable endpoint by analyzing the plugin’s AJAX actions (e.g., using browser developer tools or source code review).
2. Craft a request to the vulnerable endpoint without authentication:

   curl -X POST http://target/wp-admin/admin-ajax.php \
        -d "action=wpcomplete_export_data"
   

3. Observe the response containing sensitive data (e.g., completion logs, user data).

Expected Output: The server returns data that should be restricted to authenticated administrators.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual AJAX requests to /wp-admin/admin-ajax.php with unknown or suspicious action parameters.
• Look for requests from unauthenticated users to endpoints that typically require authentication.

Defense:

• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php from unauthenticated users unless explicitly whitelisted.
• Disable the WPComplete plugin until a patch is available.
• Use a WordPress security plugin (e.g., Wordfence) to add virtual patching.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action parameters not preceded by a valid WordPress nonce.
  • Requests from IP addresses not associated with authenticated users.
• File IOCs:
  • Modified or unexpected entries in the wp_options table related to WPComplete.
• Log IOCs:
  • WordPress debug log entries showing failed capability checks or unexpected AJAX calls.

Detection Engineering

YARA Rule

rule CVE_2025_49906_WPComplete_Missing_Auth {
    meta:
        description = "Detects WPComplete plugin files with missing authorization checks"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49906"
    strings:
        $vuln_func = "wp_ajax_nopriv_" nocase
        $auth_check = "current_user_can" nocase
    condition:
        $vuln_func and not $auth_check
}

Sigma Rule

title: CVE-2025-49906 - WPComplete Missing Authorization Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated AJAX requests targeting WPComplete plugin endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=wpcomplete_'
    condition: selection
falsepositives:
    - Legitimate AJAX calls from authenticated users (requires correlation with session)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49906 WPComplete Missing Authorization Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wpcomplete_"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WPComplete plugin until a patched version is released.
2. Implement a WAF rule to block unauthenticated requests to admin-ajax.php with action parameters starting with wpcomplete_.
3. Monitor logs for exploitation attempts using the Sigma rule above.

Long-Term Fix:

• The vendor must release a patched version that adds proper capability checks (e.g., current_user_can('manage_options')) to all AJAX and REST endpoints.
• Users should update to the patched version as soon as it becomes available.

Workaround:

• Add a custom plugin or mu-plugin that hooks into wp_ajax_nopriv_* actions and denies them for WPComplete-related actions.

Valters IT
Securing WordPress Ecosystems One CVE at a Time