CVE-2025-64352

Executive Summary

CVE-2025-64352 is a Missing Authorization vulnerability in the WordPress plugin Essential Addons for Elementor by WPDeveloper. This flaw affects all versions up to and including 6.2.4. The vulnerability allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data modification or privilege escalation. The CVSS score is 2.7 (Low), but the risk is elevated due to the widespread use of this plugin in the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is a popular add-on for the Elementor page builder, with over 1 million active installations. The lack of a patch at the time of analysis means that all sites running version 6.2.4 or earlier are exposed. Organizations should treat this as a supply chain risk and monitor for updates from WPDeveloper.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 2.7 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Low (CVSS 2.7) but with potential for chaining with other vulnerabilities to achieve higher impact.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the plugin's AJAX handlers or REST API endpoints. The plugin fails to verify that the current user has the necessary capabilities (e.g., manage_options, edit_posts) before executing sensitive operations. This allows any unauthenticated visitor to trigger actions that should be restricted to authenticated users with specific roles.

Root Cause: The plugin uses wp_ajax_* hooks without a corresponding wp_ajax_nopriv_* check, or it improperly implements capability checks using current_user_can() with incorrect parameters.

Attack Vector: An attacker sends a crafted HTTP request to the vulnerable endpoint, bypassing authentication and authorization checks.

Impact: An attacker could:

• Modify plugin settings
• Reset configurations
• Trigger data export or import functions
• Potentially escalate privileges if combined with other flaws

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical example of the vulnerable pattern and a secure implementation.

Vulnerable Code (essential-addons-for-elementor-lite/includes/class-ajax-handler.php):

add_action('wp_ajax_eael_save_settings', 'eael_save_settings_callback');
function eael_save_settings_callback() {
    // No capability check
    update_option('eael_settings', $_POST['settings']);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_eael_save_settings', 'eael_save_settings_callback');
function eael_save_settings_callback() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    update_option('eael_settings', $_POST['settings']);
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Essential Addons for Elementor <= 6.2.4
• No authentication required

Exploitation Steps:

1. Identify vulnerable endpoints by analyzing plugin source code or using fuzzing.
2. Send a crafted POST request to the vulnerable AJAX action.

Example cURL Command:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=eael_save_settings&settings[some_option]=malicious_value"

Expected Outcome: The attacker modifies plugin settings without authentication.

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions starting with eael_ from unauthenticated users.
• Look for HTTP 200 responses to these requests without a valid session cookie.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri_path="/wp-admin/admin-ajax.php" form_data=*eael_*
| eval authenticated=if(cookie="*wordpress_logged_in*", "yes", "no")
| where authenticated="no"
| stats count by src_ip, uri, form_data

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=eael_* parameters
  • Unusual User-Agent strings (e.g., curl/7.x, python-requests/2.x)
• File:
  • Modified plugin files in /wp-content/plugins/essential-addons-for-elementor-lite/
  • New or altered options in wp_options table with prefix eael_
• Log:
  • WordPress debug log entries showing failed capability checks
  • Web server access logs with 200 responses to AJAX requests from unknown IPs

Detection Engineering

YARA Rule

rule CVE_2025_64352_Essential_Addons_Elementor {
    meta:
        description = "Detects vulnerable Essential Addons for Elementor plugin files"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "CVE-2025-64352"
    strings:
        $vuln_func = "add_action('wp_ajax_" ascii wide nocase
        $no_check = "current_user_can" ascii wide nocase
    condition:
        $vuln_func and not $no_check
}

Sigma Rule

title: CVE-2025-64352 - Essential Addons for Elementor Missing Authorization
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated AJAX requests to vulnerable Essential Addons for Elementor endpoints
author: Valters IT
date: 2025-03-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=eael_'
    condition: selection
falsepositives:
    - Legitimate admin actions (should have authentication cookie)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-64352 - Essential Addons for Elementor Missing Authorization";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=eael_"; http_client_body;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to business operations.
2. Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to admin-ajax.php with action=eael_* parameters.
3. Monitor for updates from WPDeveloper and apply the patch as soon as it becomes available.

Long-term Fix:

• The vendor must add proper capability checks using current_user_can() or wp_verify_nonce() to all AJAX handlers.
• Implement nonce verification for all actions.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.
• Restrict access to wp-admin/admin-ajax.php via .htaccess for unauthenticated users (may break legitimate functionality).

Valters IT