CVE-2025-60128

Executive Summary

CVE-2025-60128 is a Missing Authorization vulnerability in the WordPress plugin Delisho (dr-widgets-blocks) by WP Delicious. The flaw affects all versions up to and including 1.1.3. An unauthenticated attacker can exploit incorrectly configured access control security levels to perform unauthorized actions, potentially leading to information disclosure or limited data manipulation. The CVSS score is 4.3 (Medium), with an EPSS probability of 0.0%, indicating low active exploitation in the wild. No public proof-of-concept (PoC) or exploit code is available at this time. The vendor has not released a patch, and the status remains unknown.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the repository are affected. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors injecting backdoors into unmaintained forks or copies.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The low EPSS score suggests limited active exploitation, but the missing authorization can be chained with other vulnerabilities for greater impact.

Deep Dive & Mechanics

The vulnerability stems from improper access control checks in the dr-widgets-blocks plugin. The plugin fails to verify user capabilities before executing certain AJAX actions or REST API endpoints. An unauthenticated attacker can send crafted HTTP requests to trigger functions that should require administrative privileges, such as:

• Retrieving sensitive configuration data.
• Modifying widget settings.
• Accessing non-public post metadata.

The core issue lies in the class-delisho-ajax.php or similar handler files, where wp_ajax_* hooks are registered without a corresponding wp_ajax_nopriv_* check, or where capability checks like current_user_can('manage_options') are missing.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example from dr-widgets-blocks/includes/class-delisho-ajax.php):

add_action('wp_ajax_delisho_get_settings', 'delisho_get_settings_callback');
function delisho_get_settings_callback() {
    // No capability check
    $settings = get_option('delisho_settings');
    wp_send_json_success($settings);
}

Patched Code (recommended fix):

add_action('wp_ajax_delisho_get_settings', 'delisho_get_settings_callback');
function delisho_get_settings_callback() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $settings = get_option('delisho_settings');
    wp_send_json_success($settings);
}

The patch adds a capability check using current_user_can('manage_options') to ensure only administrators can access the endpoint.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Delisho plugin version <= 1.1.3 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable AJAX action (e.g., delisho_get_settings).
2. Send a crafted POST request to the WordPress admin-ajax.php endpoint:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=delisho_get_settings"

3. If successful, the response will contain sensitive plugin settings in JSON format.

Note: No public exploit code is available; this is a hypothetical exploitation scenario based on the vulnerability description.

Blue Team

Detection & Response:

• Monitor for unusual requests to /wp-admin/admin-ajax.php with unknown or suspicious action parameters.
• Look for requests from unauthenticated users to AJAX actions that should require authentication.
• Implement Web Application Firewall (WAF) rules to block access to admin-ajax.php for non-logged-in users unless explicitly needed.

Honeypot Setup:

• Deploy a fake WordPress instance with the vulnerable plugin to capture attacker behavior.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=delisho_* parameters from unauthenticated sources.
  • Unusual JSON responses containing plugin configuration data.

• File IOCs:

  • Presence of the file wp-content/plugins/dr-widgets-blocks/includes/class-delisho-ajax.php (or similar) with missing capability checks.

• Log IOCs:

  • WordPress debug log entries showing wp_ajax_delisho_* calls without corresponding user authentication.

Detection Engineering

YARA Rule

rule CVE_2025_60128_Delisho_Missing_Auth {
    meta:
        description = "Detects vulnerable Delisho plugin files with missing authorization"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60128"
    strings:
        $s1 = "add_action('wp_ajax_delisho_" nocase
        $s2 = "current_user_can" nocase
    condition:
        $s1 and not $s2
}

Sigma Rule

title: CVE-2025-60128 - Missing Authorization in Delisho Plugin
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated access to Delisho AJAX endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=delisho_'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60128 - Delisho Missing Authorization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=delisho_"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential: Deactivate and delete the dr-widgets-blocks plugin from the WordPress admin dashboard.
2. Apply virtual patching: Use a WAF to block requests to /wp-admin/admin-ajax.php with action parameters starting with delisho_ from unauthenticated users.
3. Monitor logs: Review web server and WordPress debug logs for signs of exploitation.

Long-Term Fix:

• Since no official patch is available, consider forking the plugin and adding proper capability checks (as shown in the patched code section) or migrating to an alternative plugin.
• Contact the vendor (WP Delicious) to request a security update.

Workaround:

• Restrict access to admin-ajax.php via .htaccess for non-logged-in users:

<Files "admin-ajax.php">
    Require all denied
    Require valid-user
</Files>

Note: This may break legitimate AJAX functionality for non-authenticated users.

Valters IT