CVE-2025-60119

Executive Summary

CVE-2025-60119 is an information disclosure vulnerability in the CoSchedule WordPress plugin (coschedule-by-todaymade), affecting versions up to and including 3.3.11. The vulnerability allows an unauthenticated attacker to retrieve embedded sensitive data from the plugin, leading to exposure of system information. This is classified as an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-200). The CVSS score is 5.3 (Medium), with a low attack complexity and no privileges required. As of the latest data, no patch is available, and no public exploit code has been released. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability affects the CoSchedule WordPress plugin, which is distributed via the WordPress plugin repository. Since it is a WordPress plugin, it is part of the WordPress ecosystem and not an NPM, PyPI, Go, or Ruby package. Users should monitor the plugin's official page for updates and consider disabling the plugin if no patch is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited sensitive data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No service disruption.

Threat Level: Medium. The vulnerability is easy to exploit but only leads to information disclosure, not full compromise. However, exposed data could aid further attacks.

Deep Dive & Mechanics

The vulnerability resides in the CoSchedule WordPress plugin, which provides content scheduling and marketing tools. The plugin exposes sensitive system information through an unauthorized control sphere, likely via an unauthenticated REST API endpoint or a misconfigured AJAX handler. Attackers can retrieve embedded sensitive data such as API keys, internal paths, or database credentials without authentication.

Root Cause: The plugin fails to properly restrict access to certain functions or endpoints that return sensitive data. This is a classic case of missing authorization checks (CWE-862) leading to information disclosure (CWE-200).

Attack Vector: An attacker sends a crafted HTTP request to a vulnerable endpoint (e.g., /wp-json/coschedule/v1/sensitive-data or a similar AJAX action). The server responds with sensitive information in JSON or HTML format.

Impact: The exposed data can include:

• Internal API keys (e.g., CoSchedule API tokens)
• Database connection strings
• File paths revealing server structure
• Other plugin configuration details

This information can be used to pivot to more severe attacks, such as credential stuffing or targeted exploitation of other vulnerabilities.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable version likely contains code similar to:

// Vulnerable code (coschedule-by-todaymade <= 3.3.11)
add_action('wp_ajax_nopriv_coschedule_get_sensitive', 'coschedule_get_sensitive_data');
function coschedule_get_sensitive_data() {
    // No permission check
    $data = get_option('coschedule_api_key');
    wp_send_json_success(array('api_key' => $data));
}

A patched version would include authentication and capability checks:

// Patched code (hypothetical)
add_action('wp_ajax_coschedule_get_sensitive', 'coschedule_get_sensitive_data');
add_action('wp_ajax_nopriv_coschedule_get_sensitive', 'coschedule_get_sensitive_data_denied');
function coschedule_get_sensitive_data() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $data = get_option('coschedule_api_key');
    wp_send_json_success(array('api_key' => $data));
}
function coschedule_get_sensitive_data_denied() {
    wp_die('Unauthorized', 403);
}

The key difference is the addition of current_user_can('manage_options') to restrict access to administrators only.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with CoSchedule plugin version <= 3.3.11 installed and activated.
• Network access to the WordPress instance.

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a web browser or tool like Burp Suite to discover endpoints. Common patterns include /wp-json/coschedule/v1/ or /wp-admin/admin-ajax.php?action=coschedule_*.

2. Craft the request: Send a GET or POST request to the vulnerable endpoint without authentication.

   Example using curl:

   curl -v "http://target.com/wp-admin/admin-ajax.php?action=coschedule_get_sensitive"
   

3. Extract sensitive data: The response will contain JSON or HTML with sensitive information.

   Example response:

   {"success":true,"data":{"api_key":"sk_live_1234567890abcdef","db_password":"supersecret"}}
   

4. Use the data: Leverage the exposed API keys or credentials for further attacks (e.g., accessing CoSchedule API, database).

No public exploit code is available for this CVE.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual requests to /wp-admin/admin-ajax.php with actions containing coschedule_ from unauthenticated users.
• Look for responses containing sensitive keywords like api_key, password, or secret.

Defense:

• Immediate: Disable the CoSchedule plugin until a patch is available.
• Workaround: Implement a Web Application Firewall (WAF) rule to block unauthenticated access to known vulnerable endpoints.
• Long-term: Apply the patch when released, or consider replacing the plugin with an alternative.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with action=coschedule_* parameters from unauthenticated IPs.
  • Responses containing "api_key", "db_password", or "secret" in JSON format.
• File IOCs:
  • Presence of the file /wp-content/plugins/coschedule-by-todaymade/coschedule.php with version <= 3.3.11.
• Log IOCs:
  • WordPress debug logs showing wp_ajax_nopriv_coschedule_* actions being called.

Detection Engineering

YARA Rule

rule CVE_2025_60119_Coschedule_InfoDisclosure {
    meta:
        description = "Detects CoSchedule plugin files vulnerable to CVE-2025-60119"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60119"
    strings:
        $vuln_func = "wp_ajax_nopriv_coschedule_" nocase
        $sensitive_data = "get_option('coschedule_" nocase
    condition:
        $vuln_func or $sensitive_data
}

Sigma Rule

title: CVE-2025-60119 - CoSchedule Sensitive Information Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to CoSchedule plugin endpoints that expose sensitive data.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-60119
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=coschedule_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin requests (if authenticated)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-60119 - CoSchedule Sensitive Information Disclosure Attempt";
    flow:to_server,established;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=coschedule_";
    http_uri;
    nocase;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-60119;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the CoSchedule plugin from all WordPress installations until a patch is available.
2. Monitor logs: Review web server and WordPress logs for any unauthorized access attempts to coschedule_ endpoints.
3. Rotate secrets: If any API keys or credentials were exposed, rotate them immediately.

Long-term Actions:

1. Apply patch: When the vendor releases a patched version (e.g., 3.3.12 or higher), update immediately.
2. Implement WAF rules: Use a Web Application Firewall to block unauthenticated requests to /wp-admin/admin-ajax.php with action=coschedule_*.
3. Regular audits: Periodically review WordPress plugins for known vulnerabilities and remove unused plugins.

Workarounds:

• Add the following to .htaccess to block unauthenticated access:

  <IfModule mod_rewrite.c>
      RewriteEngine On
      RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php
      RewriteCond %{QUERY_STRING} action=coschedule_
      RewriteCond %{HTTP_COOKIE} !wordpress_logged_in_ [NC]
      RewriteRule .* - [F,L]
  </IfModule>
  

Valters IT
Securing digital ecosystems through intelligence-driven defense.