CVE-2025-63078

Executive Summary

CVE-2025-63078 is a Broken Access Control vulnerability affecting the Restaurant Menu by MotoPress WordPress plugin, versions up to and including 2.4.11. This flaw allows unauthenticated attackers to bypass authorization checks and access restricted functionality or data. The vulnerability is classified as a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). With a CVSS score of 4.3 (Medium), the primary impact is on confidentiality, as an attacker can potentially read sensitive information without proper authentication. No public proof-of-concept (PoC) or exploit code has been released, and the patch status remains unknown.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates from the vendor (MotoPress) and apply patches immediately upon release. Since this is a PHP-based plugin, no NPM, PyPI, Go, or Ruby package management is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No victim action required.
• Scope (S): Unchanged – The vulnerable component remains isolated.
• Confidentiality (C): Low – Limited information disclosure possible.
• Integrity (I): None – No data modification risk.
• Availability (A): None – No denial-of-service impact.

Threat Level: Medium. While the impact is limited to low confidentiality loss, the ease of exploitation (no authentication, network-based) makes it a viable target for automated scanning and information gathering.

Deep Dive & Mechanics

The vulnerability stems from improper authorization checks in the Restaurant Menu by MotoPress plugin. Specifically, certain AJAX actions or REST API endpoints (common in WordPress plugins) fail to verify user capabilities before executing sensitive operations. This allows an unauthenticated attacker to:

• Access menu item details, pricing, or configuration data.
• Retrieve non-public plugin settings or cached data.
• Potentially enumerate other users or system information.

The root cause is a missing or insufficient current_user_can() check in the plugin's PHP code. For example, a function hooked to wp_ajax_nopriv_* (which allows unauthenticated access) might expose data intended only for authenticated users with specific roles (e.g., edit_posts).

Vulnerable vs. Patched Code

Since no official patch has been released, the following is a hypothetical comparison based on common fixes for this type of vulnerability.

Vulnerable Code (example from restaurant-menu/includes/class-ajax.php):

add_action('wp_ajax_nopriv_get_menu_items', 'rm_get_menu_items');
function rm_get_menu_items() {
    $menu_id = intval($_POST['menu_id']);
    $items = get_posts(array('post_type' => 'rmp_menu_item', 'meta_key' => 'menu_id', 'meta_value' => $menu_id));
    wp_send_json_success($items);
}

Patched Code (hypothetical):

add_action('wp_ajax_get_menu_items', 'rm_get_menu_items');
add_action('wp_ajax_nopriv_get_menu_items', 'rm_get_menu_items_public');
function rm_get_menu_items() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $menu_id = intval($_POST['menu_id']);
    $items = get_posts(array('post_type' => 'rmp_menu_item', 'meta_key' => 'menu_id', 'meta_value' => $menu_id));
    wp_send_json_success($items);
}
function rm_get_menu_items_public() {
    // Only return public data
    $menu_id = intval($_POST['menu_id']);
    $items = get_posts(array('post_type' => 'rmp_menu_item', 'meta_key' => 'menu_id', 'meta_value' => $menu_id, 'post_status' => 'publish'));
    wp_send_json_success($items);
}

The fix adds a capability check (current_user_can('edit_posts')) for authenticated actions and separates public endpoints to only return published data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site running Restaurant Menu by MotoPress <= 2.4.11.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php with action get_menu_items).
2. Send a crafted POST request without authentication:

   curl -X POST http://target/wp-admin/admin-ajax.php \
        -d "action=get_menu_items&menu_id=1"
   

3. If successful, the response will contain menu item data (including non-public fields like draft items or pricing).

Expected Output:

{"success":true,"data":[{"ID":1,"post_title":"Steak","post_status":"draft","menu_price":"29.99"}]}

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions related to the plugin (e.g., get_menu_items, save_menu_settings).
• Look for requests without a valid wpnonce or authentication cookie.

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to known vulnerable endpoints.
• Use a WordPress security plugin to enforce capability checks.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=get_menu_items (or similar) from unauthenticated sources.
  • Response bodies containing JSON with post_status values other than publish (e.g., draft, private).

• File IOCs:

  • Modified plugin files in /wp-content/plugins/restaurant-menu/ (if attacker uploads a backdoor).
  • Unexpected files in the uploads directory.

• Log IOCs:

  • Repeated 403 errors from admin-ajax.php if a WAF is in place.
  • Access logs showing POST /wp-admin/admin-ajax.php with no preceding login.

Detection Engineering

YARA Rule

rule CVE_2025_63078_Restaurant_Menu_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2025-63078 in Restaurant Menu by MotoPress"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63078"
    strings:
        $ajax_action = "action=get_menu_items" nocase
        $ajax_url = "/wp-admin/admin-ajax.php" nocase
    condition:
        $ajax_action and $ajax_url
}

Sigma Rule

title: CVE-2025-63078 - Restaurant Menu Broken Access Control
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated AJAX requests to the vulnerable endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=get_menu_items'
    condition: selection
falsepositives:
    - Legitimate plugin functionality if accessed by authenticated users (but this rule targets unauthenticated)
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-63078 - Restaurant Menu Broken Access Control Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=get_menu_items"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Apply a virtual patch using a WAF to block unauthenticated requests to admin-ajax.php with plugin-specific actions.
3. Monitor for updates from MotoPress and apply the official patch as soon as it is released.

Long-term Fix:

• The vendor must add proper capability checks (e.g., current_user_can('edit_posts')) to all AJAX handlers.
• Implement nonce verification for all authenticated actions.

Workaround:

• If the plugin must remain active, restrict access to admin-ajax.php via .htaccess or server configuration for unauthenticated users (note: this may break other functionality).

Valters IT
Securing Digital Frontiers