CVE-2025-64243

Executive Summary

CVE-2025-64243 is a Missing Authorization vulnerability in the WordPress plugin Directory Pro (by e-plugins), affecting versions up to and including 2.5.6. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to sensitive directory data. The vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx misconfigurations.

The vulnerability has a CVSS score of 4.3 (Medium), with an EPSS score of 0.0% indicating low exploitation likelihood at this time. No public proof-of-concept (PoC) or exploit code has been released, and no patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No service disruption.

Threat Level: Medium. While the CVSS score is moderate, the lack of authentication requirements and the potential for data leakage in directory listings make this a concern for sites using Directory Pro.

Deep Dive & Mechanics

The vulnerability resides in the Directory Pro plugin's access control mechanisms. The plugin fails to properly enforce authorization checks on certain REST API endpoints or AJAX actions, allowing unauthenticated users to access directory entries, metadata, or configuration data that should be restricted.

Root Cause: The plugin uses current_user_can() checks inconsistently or omits them entirely in some functions. Specifically, the directory_pro shortcode and associated AJAX handlers do not verify user capabilities before returning sensitive data.

Attack Vector: An attacker can send crafted HTTP requests to the WordPress site, targeting endpoints such as:

• /wp-admin/admin-ajax.php?action=directory_pro_get_listings
• /wp-json/directory-pro/v1/entries

These endpoints may return directory entries without proper authentication, exposing names, contact details, and other private information.

Impact: Unauthorized data disclosure, potential enumeration of directory entries, and exposure of business or personal information.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common authorization fixes.

Vulnerable Code (directory-pro/includes/class-ajax.php):

add_action('wp_ajax_nopriv_directory_pro_get_listings', 'directory_pro_get_listings');
function directory_pro_get_listings() {
    $listings = get_posts(array('post_type' => 'directory_entry', 'posts_per_page' => -1));
    wp_send_json($listings);
}

Patched Code (Hypothetical):

add_action('wp_ajax_nopriv_directory_pro_get_listings', 'directory_pro_get_listings');
function directory_pro_get_listings() {
    if (!current_user_can('read_directory_entries')) {
        wp_die('Unauthorized', 403);
    }
    $listings = get_posts(array('post_type' => 'directory_entry', 'posts_per_page' => -1));
    wp_send_json($listings);
}

The patch adds a capability check (current_user_can()) before processing the request, ensuring only authorized users can access the data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Directory Pro <= 2.5.6 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the target WordPress site.
2. Send a crafted request to the AJAX endpoint:

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
        -d "action=directory_pro_get_listings"
   

3. If successful, the response will contain JSON data of directory entries.
4. For REST API exploitation:

   curl "http://target.com/wp-json/directory-pro/v1/entries"
   

Expected Output: JSON array of directory entries with fields like post_title, post_content, and custom meta fields.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual requests to /wp-admin/admin-ajax.php with action=directory_pro_get_listings from unauthenticated IPs.
• Look for spikes in REST API calls to /wp-json/directory-pro/v1/entries.

Defense:

• Implement a Web Application Firewall (WAF) rule to block unauthenticated access to these endpoints.
• Apply virtual patching by adding a custom plugin that adds capability checks.
• Restrict access to directory data via server-level authentication (e.g., .htaccess).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with action=directory_pro_get_listings and no authentication cookies.
  • HTTP requests to /wp-json/directory-pro/v1/entries without a valid Authorization header.
• File IOCs:
  • Modified or suspicious files in /wp-content/plugins/directory-pro/.
  • Unexpected log entries in WordPress debug logs showing unauthorized access attempts.
• Behavioral IOCs:
  • Unusual data exfiltration patterns from directory pages.
  • Multiple failed authentication attempts followed by successful data retrieval.

Detection Engineering

YARA Rule

rule CVE_2025_64243_Directory_Pro_Unauth {
    meta:
        description = "Detects exploitation attempts for CVE-2025-64243 in Directory Pro plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-64243"
    strings:
        $ajax_action = "directory_pro_get_listings"
        $rest_endpoint = "/directory-pro/v1/entries"
        $wp_json = "/wp-json"
    condition:
        any of ($ajax_action, $rest_endpoint) and $wp_json
}

Sigma Rule

title: CVE-2025-64243 - Directory Pro Unauthenticated Data Access
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects unauthenticated requests to Directory Pro plugin endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=directory_pro_get_listings'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin requests (rare)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-64243 - Directory Pro Unauthenticated Data Access";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=directory_pro_get_listings"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-64243;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to business operations.
2. Apply virtual patching using a WAF or custom code to block unauthenticated access to the vulnerable endpoints.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Await an official patch from e-plugins. Until then, consider replacing Directory Pro with an alternative directory plugin that has proper authorization controls.
• Implement a custom WordPress plugin that adds capability checks to the vulnerable endpoints:

  add_action('init', function() {
      remove_action('wp_ajax_nopriv_directory_pro_get_listings', 'directory_pro_get_listings');
  });
  

Workaround:

• Use .htaccess to restrict access to the plugin's AJAX handlers:

  <FilesMatch "admin-ajax\.php">
      Require all denied
      Require ip 127.0.0.1
  </FilesMatch>
  

Valters IT
Securing Digital Frontiers