CVE-2025-63079

Executive Summary

CVE-2025-63079 is a Broken Access Control vulnerability in the WordPress plugin Live Copy Paste for Elementor, affecting versions <= 1.5.3. This flaw allows unauthenticated attackers to bypass authorization checks and perform actions intended for higher-privileged users, such as copying or pasting Elementor content without proper capability validation. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. However, due to the lack of a patch and the plugin's integration with Elementor (a widely used page builder), the risk to WordPress sites remains significant.

Supply Chain & Package Security

This vulnerability resides in the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. No official patch has been released, and the vendor (Contributor) has not responded to disclosure attempts. Users are advised to remove or disable the plugin immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., content copying).
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is 4.3, the lack of a patch and the plugin's popularity elevate the risk for unmaintained sites.

Deep Dive & Mechanics

The vulnerability stems from improper capability checks in the plugin's AJAX handlers. The plugin registers actions like lcp_copy_content and lcp_paste_content without verifying that the requesting user has the edit_posts or edit_others_posts capability. This allows any unauthenticated visitor to trigger these actions, potentially copying or pasting Elementor content across posts or pages.

Root Cause: The plugin uses wp_ajax_* hooks but fails to call current_user_can() or wp_verify_nonce() before processing requests. The nonce check is either missing or improperly implemented, allowing CSRF-like attacks without a valid nonce.

Attack Flow:

1. Attacker identifies a WordPress site running the vulnerable plugin.
2. Attacker sends a crafted POST request to /wp-admin/admin-ajax.php with action=lcp_copy_content and target post ID.
3. The plugin copies the Elementor content from the specified post without authentication.
4. Attacker can then paste the content into another post via lcp_paste_content, potentially exposing draft or private content.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.5.3):

add_action('wp_ajax_lcp_copy_content', 'lcp_copy_content_callback');
function lcp_copy_content_callback() {
    $post_id = intval($_POST['post_id']);
    $content = get_post_meta($post_id, '_elementor_data', true);
    // No capability check
    wp_send_json_success($content);
}

Patched Code (Hypothetical):

add_action('wp_ajax_lcp_copy_content', 'lcp_copy_content_callback');
function lcp_copy_content_callback() {
    if (!current_user_can('edit_posts') || !wp_verify_nonce($_POST['_wpnonce'], 'lcp_nonce')) {
        wp_die('Unauthorized');
    }
    $post_id = intval($_POST['post_id']);
    $content = get_post_meta($post_id, '_elementor_data', true);
    wp_send_json_success($content);
}

Exploitation & Lab Setup

Red Team

Prerequisites: A WordPress site with Live Copy Paste for Elementor <= 1.5.3 and Elementor installed.

Exploit Steps:

1. Identify the target site's admin-ajax.php URL.
2. Send a POST request to copy content from a target post (e.g., post ID 1):

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=lcp_copy_content&post_id=1"

3. If successful, the response will contain the Elementor data JSON.
4. To paste the content into another post (e.g., post ID 2):

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=lcp_paste_content&post_id=2&content=<copied_json>"

Note: No public exploit code exists; this is a proof-of-concept.

Blue Team

Detection: Monitor for unusual AJAX requests to admin-ajax.php with action=lcp_copy_content or lcp_paste_content from unauthenticated users. Look for repeated requests targeting multiple post IDs.

Hunting Query (Splunk):

index=web sourcetype=access_combined
uri_path="/wp-admin/admin-ajax.php"
form_data=*lcp_copy_content*
| stats count by clientip, form_data
| where count > 5

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with parameters action=lcp_copy_content or action=lcp_paste_content.
• File: Presence of the plugin directory /wp-content/plugins/live-copy-paste-for-elementor/.
• Log: WordPress debug log entries showing lcp_copy_content_callback or lcp_paste_content_callback calls without authentication.
• Behavior: Unauthorized copying of Elementor content between posts.

Detection Engineering

YARA Rule

rule CVE_2025_63079_Live_Copy_Paste_Elementor {
    meta:
        description = "Detects vulnerable Live Copy Paste for Elementor plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63079"
    strings:
        $ajax_copy = "lcp_copy_content" ascii wide nocase
        $ajax_paste = "lcp_paste_content" ascii wide nocase
        $no_cap = "current_user_can" ascii wide nocase
    condition:
        $ajax_copy or $ajax_paste and not $no_cap
}

Sigma Rule

title: CVE-2025-63079 - Broken Access Control in Live Copy Paste for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated AJAX requests to copy/paste Elementor content
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "action=lcp_copy_content"
            - "action=lcp_paste_content"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-63079 - Live Copy Paste for Elementor Broken Access Control";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=lcp_copy_content"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete live-copy-paste-for-elementor from the WordPress admin panel.
2. Web Application Firewall (WAF) – Block requests to admin-ajax.php containing lcp_copy_content or lcp_paste_content from unauthenticated users.
3. Monitor logs – Review access logs for exploitation attempts.

Long-Term Fix:

• Since no patch is available, migrate to an alternative plugin or implement custom code with proper capability checks.
• Apply the principle of least privilege to all WordPress AJAX handlers.

Valters IT – DevSecOps & Cyber Threat Intelligence.