CVE-2025-54734

Executive Summary

CVE-2025-54734 is a Missing Authorization vulnerability in the B Slider WordPress plugin (slug: b-slider) developed by bplugins. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification. The vulnerability affects all versions up to and including 1.1.30. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code or exploit templates are available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for unpatched WordPress installations.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and can be installed directly from the WordPress admin dashboard. Since no patch is available, site administrators must consider removing or disabling the plugin until a fix is released. The lack of a patch also means that supply chain integrity is compromised for any site using this plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to low-level confidentiality and integrity breaches. However, in a WordPress context, this could lead to unauthorized access to slider settings, media files, or other plugin data.

Deep Dive & Mechanics

The vulnerability stems from a Missing Authorization check (CWE-862) in the B Slider plugin's REST API endpoints or AJAX handlers. The plugin likely exposes functions that allow users to retrieve, modify, or delete slider data without verifying the user's capabilities (e.g., edit_posts or manage_options). An unauthenticated attacker can send crafted HTTP requests to these endpoints to:

• View or modify slider configurations.
• Access or delete slider media attachments.
• Potentially escalate privileges if the plugin interacts with other WordPress components.

The flaw is classified under MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application). The attack surface is the WordPress admin-ajax.php or REST API routes registered by the plugin.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve adding capability checks to all plugin AJAX and REST API callbacks. For example:

Vulnerable Code (hypothetical):

add_action('wp_ajax_b_slider_get_data', 'b_slider_get_data_callback');
add_action('wp_ajax_nopriv_b_slider_get_data', 'b_slider_get_data_callback');

function b_slider_get_data_callback() {
    // No capability check
    $slider_id = $_POST['slider_id'];
    // Process request...
    wp_send_json_success($data);
}

Patched Code (hypothetical):

add_action('wp_ajax_b_slider_get_data', 'b_slider_get_data_callback');
// Remove nopriv action to require authentication

function b_slider_get_data_callback() {
    // Add capability check
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $slider_id = $_POST['slider_id'];
    // Process request...
    wp_send_json_success($data);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code is available, a penetration tester would need to reverse-engineer the plugin to identify vulnerable endpoints. Steps:

1. Identify AJAX actions: Search the plugin source for wp_ajax_ and wp_ajax_nopriv_ hooks.
2. Craft requests: Use curl or Burp Suite to send requests to /wp-admin/admin-ajax.php with the action parameter.
3. Test for missing authorization: Attempt to access endpoints without authentication.

Example curl command (hypothetical):

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  -d 'action=b_slider_get_data&slider_id=1'

If the response returns slider data without requiring a nonce or authentication, the vulnerability is confirmed.

Blue Team (Detection & Defense)

• Monitor for unusual AJAX requests: Look for requests to admin-ajax.php with unknown or suspicious action parameters.
• Check for missing nonces: Ensure all AJAX handlers validate WordPress nonces.
• Disable the plugin: Until a patch is available, deactivate and delete the B Slider plugin.
• Web Application Firewall (WAF): Create rules to block requests to known vulnerable endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action=b_slider_* parameters.
  • Unauthenticated access to plugin REST API endpoints (e.g., /wp-json/b-slider/v1/*).
• File IOCs:
  • Presence of the plugin directory /wp-content/plugins/b-slider/ with version <= 1.1.30.
• Log IOCs:
  • WordPress debug log entries showing unauthorized access attempts to plugin functions.

Detection Engineering

YARA Rule

rule CVE_2025_54734_B_Slider_Missing_Auth {
    meta:
        description = "Detects B Slider plugin files with missing authorization"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54734"
    strings:
        $vuln_func = "wp_ajax_nopriv_" nocase
        $vuln_action = "b_slider_" nocase
    condition:
        $vuln_func and $vuln_action
}

Sigma Rule

title: CVE-2025-54734 - B Slider Missing Authorization
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated AJAX requests to B Slider plugin endpoints
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=b_slider_'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54734 - B Slider Missing Authorization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=b_slider_"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate Action: Disable and remove the B Slider plugin from all WordPress installations until a patch is released.
• Workaround: If the plugin is critical, restrict access to admin-ajax.php using .htaccess or a WAF to only allow authenticated requests.
• Long-term: Monitor the plugin's official page for updates. Consider switching to an alternative slider plugin with active security maintenance.
• Vendor Contact: Attempt to contact bplugins via their support channels to request a security patch.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert