CVE-2025-60120

Executive Summary

CVE-2025-60120 is a Missing Authorization vulnerability in the WordPress plugin WP Directory Kit (wpdirectorykit). This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to sensitive data or functionality. The vulnerability affects all versions up to and including 1.4.0. The vendor has not released a patch, and no public exploit code or proof-of-concept is currently available. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time, but the risk remains due to the lack of a patch.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed WP Directory Kit from the WordPress dashboard or via direct download are affected. No known supply chain compromise has been reported, but the absence of a patch means that any site running this plugin is at risk until a fix is applied.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to low confidentiality loss. However, the lack of a patch elevates the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability stems from a Missing Authorization check (CWE-862) in the WP Directory Kit plugin. The plugin likely exposes REST API endpoints or AJAX actions that perform sensitive operations (e.g., reading directory listings, accessing private data) without verifying the user’s permissions. An unauthenticated attacker can send crafted HTTP requests to these endpoints to retrieve information that should be restricted.

The core issue is that the plugin fails to call current_user_can() or similar WordPress capability checks before executing privileged actions. This is a common pattern in WordPress plugins where developers assume that only authenticated users will access certain endpoints, but do not enforce the check.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described hypothetically:

Vulnerable Code (wpdirectorykit <= 1.4.0):

add_action('wp_ajax_nopriv_get_directory_data', 'get_directory_data');
function get_directory_data() {
    // No permission check
    $data = $wpdb->get_results("SELECT * FROM wp_directory_entries");
    wp_send_json($data);
}

Patched Code (Hypothetical):

add_action('wp_ajax_nopriv_get_directory_data', 'get_directory_data');
function get_directory_data() {
    if (!current_user_can('read_private_directories')) {
        wp_die('Unauthorized', 403);
    }
    $data = $wpdb->get_results("SELECT * FROM wp_directory_entries");
    wp_send_json($data);
}

The patched version adds a capability check before processing the request, ensuring only authorized users can access the data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with WP Directory Kit <= 1.4.0 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=get_directory_data).
2. Send a crafted HTTP request to retrieve sensitive data.

Example cURL command:

curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
  -d "action=get_directory_data"

Expected Output:

[
  {"id":1,"title":"Private Listing","email":"admin@example.com"},
  {"id":2,"title":"Confidential Entry","email":"user@example.com"}
]

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions related to WP Directory Kit (e.g., get_directory_data, wpdirectorykit_*).
• Look for requests from unauthenticated users (no wordpress_logged_in_* cookie) that trigger these actions.

Defense:

• Immediately disable or remove the WP Directory Kit plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to known vulnerable endpoints.
• Use a WordPress security plugin to enforce capability checks on all AJAX actions.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /wp-admin/admin-ajax.php with parameter action=get_directory_data (or similar) from unauthenticated sources.
  • Unusual JSON responses containing directory listing data from the same endpoint.

• File IOCs:

  • Presence of the plugin directory /wp-content/plugins/wpdirectorykit/ with version <= 1.4.0.

• Log IOCs:

  • WordPress debug logs showing wp_ajax_nopriv_* actions being called without authentication.

Detection Engineering

YARA Rule

rule CVE_2025_60120_WP_Directory_Kit_Missing_Auth {
    meta:
        description = "Detects vulnerable WP Directory Kit plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-60120"
    strings:
        $vuln_func = "wp_ajax_nopriv_" nocase
        $plugin_slug = "wpdirectorykit" nocase
    condition:
        $plugin_slug and $vuln_func
}

Sigma Rule

title: CVE-2025-60120 - WP Directory Kit Missing Authorization
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated AJAX requests to WP Directory Kit endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=get_directory_data'
    condition: selection
falsepositives:
    - Legitimate admin actions (if authenticated)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-60120 - WP Directory Kit Missing Authorization Attempt";
    flow:to_server;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=get_directory_data"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete WP Directory Kit from all WordPress installations until a patch is released.
2. Implement virtual patching – Use a WAF to block requests to admin-ajax.php with actions containing wpdirectorykit or get_directory_data from unauthenticated users.
3. Monitor logs – Review web server and WordPress logs for signs of exploitation.

Long-Term Fix:

• The vendor must release a patched version that adds proper capability checks (e.g., current_user_can()) to all AJAX and REST endpoints.
• Users should update to the latest version once available.

Workaround:

• If the plugin is critical, consider forking it and adding the missing authorization checks manually, or use a WordPress security plugin that enforces authentication on all AJAX actions.

Valters IT