CVE-2025-54047

Executive Summary

CVE-2025-54047 is a Missing Authorization vulnerability in the Cost Calculator plugin (ql-cost-calculator) by QuanticaLabs, affecting versions up to and including 7.4. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data exposure or manipulation of calculator configurations. The vulnerability resides in the WordPress plugin ecosystem, specifically within the plugin's REST API or AJAX handlers that fail to properly verify user permissions before executing sensitive operations.

The CVSS score of 4.3 (Medium) reflects the low attack complexity and network-based attack vector, but the impact is limited to confidentiality (Low) with no direct effect on integrity or availability. The EPSS score of 0.0% indicates a very low probability of exploitation in the wild at this time, but the lack of a patch increases the risk for unmaintained installations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory and potentially third-party marketplaces. Since the plugin is not an NPM, PyPI, Go, or Ruby package, supply chain risks are limited to the plugin's update mechanism and the integrity of the plugin files hosted on the WordPress repository. Users should verify the plugin's checksum and ensure they are downloading from the official source.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains within its security authority.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for chaining with other vulnerabilities could elevate the risk. The vulnerability is particularly dangerous for sites with sensitive calculator data (e.g., pricing formulas, user inputs).

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the plugin's AJAX actions or REST API endpoints. The ql-cost-calculator plugin likely registers several WordPress AJAX hooks (both wp_ajax_ and wp_ajax_nopriv_) to handle front-end and back-end operations. The flaw occurs when a nopriv hook (accessible to unauthenticated users) is used for an operation that should require authentication, or when the capability check (e.g., current_user_can('manage_options')) is omitted entirely.

Root Cause: The plugin fails to validate the user's permissions before executing sensitive functions such as:

• Retrieving saved calculator templates or configurations.
• Modifying calculator settings (e.g., price formulas, field definitions).
• Accessing stored calculation results or logs.

Attack Vector: An unauthenticated attacker sends a crafted HTTP request to the vulnerable endpoint, e.g., /wp-admin/admin-ajax.php?action=ql_cost_calculator_get_templates. The server processes the request without verifying the user's role, returning sensitive data.

Impact: Attackers can enumerate all calculator configurations, extract pricing logic, or modify calculator behavior (if write operations are also unprotected). This could lead to business logic abuse, data leakage, or defacement of calculator outputs.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common WordPress plugin security practices.

Vulnerable Code (example from ql-cost-calculator.php):

add_action('wp_ajax_nopriv_ql_cost_calculator_get_templates', 'ql_get_templates');
function ql_get_templates() {
    global $wpdb;
    $templates = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}ql_cost_calculator_templates");
    wp_send_json_success($templates);
}

Patched Code (hypothetical):

add_action('wp_ajax_ql_cost_calculator_get_templates', 'ql_get_templates');
add_action('wp_ajax_nopriv_ql_cost_calculator_get_templates', 'ql_get_templates_public');
function ql_get_templates() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    global $wpdb;
    $templates = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}ql_cost_calculator_templates");
    wp_send_json_success($templates);
}
function ql_get_templates_public() {
    // Only return public, non-sensitive data
    wp_send_json_error('Not available');
}

Key Differences:

• The patched version separates public and private AJAX hooks.
• The private hook includes a capability check (current_user_can('manage_options')).
• The public hook returns an error or limited data.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress instance with Cost Calculator plugin <= 7.4 installed and activated.
• Network access to the target site.

Step 1: Identify Vulnerable Endpoints Use a tool like Burp Suite or curl to enumerate AJAX actions. Common actions include:

• ql_cost_calculator_get_templates
• ql_cost_calculator_save_template
• ql_cost_calculator_get_results

Step 2: Exploit Missing Authorization Send an unauthenticated request to retrieve templates:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=ql_cost_calculator_get_templates"

If successful, the response will contain JSON data with template details.

Step 3: Escalate (if write operations are also unprotected) Modify a calculator template:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=ql_cost_calculator_save_template&template_id=1&data=malicious_data"

Step 4: Extract Sensitive Information Parse the response to extract pricing formulas, user data, or other stored information.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action parameters starting with ql_cost_calculator_ from unauthenticated users.
• Look for repeated requests to the same endpoint without a valid nonce or session cookie.

Hunting:

• Search web server logs for patterns like:

  POST /wp-admin/admin-ajax.php HTTP/1.1
  Content-Type: application/x-www-form-urlencoded
  action=ql_cost_calculator_get_templates
  

• Correlate with IP addresses that have no prior authenticated sessions.

Prevention:

• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to ql_cost_calculator_* actions.
• Use a plugin like "Wordfence" to add virtual patching for known vulnerabilities.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /wp-admin/admin-ajax.php with body containing action=ql_cost_calculator_ and no Cookie header.
• Responses containing JSON arrays with keys like template_name, formula, fields.

File IOCs:

• Modified plugin files in /wp-content/plugins/ql-cost-calculator/ (check file integrity via checksums).
• Unexpected entries in the wp_options table related to ql_cost_calculator_*.

Log IOCs:

• Web server logs showing 200 responses to admin-ajax.php from unauthenticated IPs.
• PHP error logs with warnings about undefined array keys (if the exploit triggers errors).

Detection Engineering

YARA Rule

rule CVE_2025_54047_Cost_Calculator_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-54047 in Cost Calculator plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-54047"
    strings:
        $ajax_action = "ql_cost_calculator_" nocase
        $admin_ajax = "admin-ajax.php" nocase
        $unauth_pattern = /action=ql_cost_calculator_(get|save|delete)_[a-z]+/
    condition:
        $admin_ajax and $ajax_action and #unauth_pattern > 0
}

Sigma Rule

title: CVE-2025-54047 - Cost Calculator Unauthenticated AJAX Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated requests to Cost Calculator AJAX endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=ql_cost_calculator_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate plugin updates or admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54047 - Cost Calculator Unauthenticated AJAX Access"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=ql_cost_calculator_"; http_client_body; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for business operations.
2. Apply virtual patching via WAF rules to block unauthenticated requests to ql_cost_calculator_* actions.
3. Restrict access to admin-ajax.php using .htaccess or server-level rules for unauthenticated users.

Long-Term Fix:

• Since no official patch exists, consider forking the plugin and adding proper capability checks (see "Vulnerable vs. Patched Code" section).
• Monitor the plugin's official page for updates and apply immediately when available.
• Evaluate alternative cost calculator plugins with active security maintenance.

Compromise Assessment:

• Review web server logs for any successful exploitation attempts.
• Check for unauthorized modifications to calculator templates or settings.
• Rotate any API keys or secrets that may have been exposed through the plugin.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2025-54047