CVE-2025-58601

Executive Summary

CVE-2025-58601 is a Missing Authorization vulnerability in the RadiusTheme Classified Listing WordPress plugin, affecting all versions up to and including 5.0.6. This flaw allows authenticated attackers (with subscriber-level privileges or higher) to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to sensitive data or functionality. The vulnerability has a CVSS score of 4.3 (Medium), with a low attack complexity and no user interaction required beyond authentication. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild, but the risk remains for unpatched WordPress sites.

Supply Chain & Package Security

This vulnerability resides in the WordPress plugin ecosystem, specifically the classified-listing plugin by RadiusTheme. Since WordPress plugins are distributed via the official WordPress Plugin Directory and third-party marketplaces, the supply chain risk is moderate. Users who installed the plugin from the official directory are affected, and no patched version is available. Administrators should monitor the plugin’s changelog and consider disabling or replacing the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid WordPress user account (e.g., subscriber).
• User Interaction (UI): None (N) – No victim action needed.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): Low (L) – Limited unauthorized data access possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability requires authentication, limiting the attack surface to registered users. However, in multi-tenant or membership sites, this could expose sensitive listing data or administrative functions.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the classified-listing plugin’s REST API endpoints or AJAX handlers. The plugin likely fails to verify that the current user has the required capabilities (e.g., edit_posts, manage_options) before executing sensitive operations such as viewing, editing, or deleting classified listings. This allows an authenticated attacker with minimal privileges (e.g., subscriber) to:

• Access or modify listings belonging to other users.
• View or change plugin settings.
• Escalate privileges if combined with other flaws.

The core issue is in the plugin’s access control logic, where functions like current_user_can() or wp_verify_nonce() are either missing or improperly implemented. The vulnerability is classified under CWE-862: Missing Authorization.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common WordPress plugin patterns.

Vulnerable Code (example from classified-listing <= 5.0.6):

// In a REST API endpoint or AJAX handler
function handle_listing_action() {
    $listing_id = $_POST['listing_id'];
    // Missing capability check
    update_post_meta($listing_id, 'listing_status', 'approved');
    wp_send_json_success();
}
add_action('wp_ajax_classified_update_listing', 'handle_listing_action');

Patched Code (hypothetical fix):

function handle_listing_action() {
    if (!current_user_can('edit_others_posts')) {
        wp_send_json_error('Unauthorized');
        return;
    }
    $listing_id = intval($_POST['listing_id']);
    if (!wp_verify_nonce($_POST['_wpnonce'], 'classified_nonce')) {
        wp_send_json_error('Invalid nonce');
        return;
    }
    update_post_meta($listing_id, 'listing_status', 'approved');
    wp_send_json_success();
}
add_action('wp_ajax_classified_update_listing', 'handle_listing_action');

The patched version adds current_user_can() and nonce verification to ensure only authorized users can perform the action.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Classified Listing plugin <= 5.0.6 installed and activated.
• A valid user account with subscriber-level privileges (e.g., username: attacker, password: password123).

Steps:

1. Log in to WordPress as the attacker user.
2. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=classified_update_listing).
3. Craft a request to exploit the missing authorization:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  -d 'action=classified_update_listing&listing_id=123&listing_status=approved' \
  --cookie 'wordpress_logged_in_xxx=attacker_session_cookie'

4. If successful, the listing with ID 123 will be modified without proper authorization.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions related to classified-listing (e.g., classified_update_listing, classified_delete_listing).
• Look for requests from low-privilege users (subscriber, contributor) attempting to modify listings.
• Enable logging of all REST API and AJAX requests in WordPress (e.g., using the WP_DEBUG_LOG constant).

Hardening:

• Disable the plugin until a patch is released.
• Restrict user roles: ensure subscribers cannot access admin AJAX endpoints.
• Implement a Web Application Firewall (WAF) rule to block suspicious AJAX requests.
• Use a WordPress security plugin (e.g., Wordfence) to monitor for unauthorized actions.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action=classified_* parameters from low-privilege users.
  • Unusual listing_id values (e.g., non-existent or belonging to other users).
• File IOCs:
  • Modified wp_postmeta entries for listings (e.g., listing_status changed without proper authorization).
• Log IOCs:
  • WordPress debug log entries showing failed capability checks or unauthorized access attempts.

Detection Engineering

YARA Rule

rule Detect_Classified_Listing_Missing_Auth {
    meta:
        description = "Detects exploitation attempts of CVE-2025-58601 in Classified Listing plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-58601"
    strings:
        $ajax_action = "classified_" ascii wide nocase
        $admin_ajax = "admin-ajax.php" ascii wide nocase
        $listing_id = "listing_id" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-58601 - Classified Listing Missing Authorization
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests exploiting missing authorization in Classified Listing plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=classified_'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-58601 - Classified Listing Missing Authorization Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=classified_"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the classified-listing plugin until a patch is released.
2. Audit user accounts – Remove any suspicious or low-privilege accounts that may have been compromised.
3. Review logs – Check for unauthorized AJAX requests or listing modifications.

Long-term Mitigation:

• Monitor the RadiusTheme plugin page for updates and apply the patch as soon as it becomes available.
• Implement the principle of least privilege for WordPress user roles.
• Use a WordPress security plugin with file integrity monitoring and login attempt limiting.
• Consider switching to an alternative classified listing plugin with active security support.

Valters IT Signature:

Valters IT Cyber Threat Intelligence
Report ID: VIT-CVE-2025-58601
Analyst: Senior DevSecOps Engineer
Date: 2025-04-10
Classification: CONFIDENTIAL