CVE-2025-66072

Executive Summary

CVE-2025-66072 is a Missing Authorization vulnerability in the UsersWP WordPress plugin by Stiofan, affecting versions up to and including 1.2.47. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to sensitive user data or administrative functions. The vulnerability has a CVSS score of 5.3 (Medium) and currently has no known patch or public exploit code. Given the WordPress ecosystem context, this issue poses a significant risk to sites using the plugin for user management and registration.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. As such, it is part of the WordPress supply chain. Users are advised to monitor the plugin’s update channel and apply any patches immediately upon release. No known malicious packages or compromised versions have been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is Medium due to the low complexity and no required privileges, but the impact is limited to confidentiality only.

Deep Dive & Mechanics

The vulnerability resides in the UsersWP plugin’s access control mechanisms. The plugin fails to properly validate user permissions before granting access to certain REST API endpoints or administrative actions. Specifically, the userswp component does not enforce authorization checks for functions that should be restricted to authenticated users with specific roles (e.g., administrators). This allows an unauthenticated attacker to:

• Enumerate registered users
• Access user metadata (e.g., email addresses, display names)
• Potentially modify user profiles or settings if other endpoints are exposed

The root cause is the use of current_user_can() checks that are either missing or incorrectly implemented, allowing requests to bypass authorization.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described below. A patched version would include proper capability checks.

Vulnerable Code (userswp/includes/class-userswp.php):

public function rest_api_callback( $request ) {
    // Missing authorization check
    $user_id = $request->get_param( 'user_id' );
    $user_data = get_userdata( $user_id );
    return rest_ensure_response( $user_data );
}

Patched Code (hypothetical):

public function rest_api_callback( $request ) {
    if ( ! current_user_can( 'edit_users' ) ) {
        return new WP_Error( 'rest_forbidden', __( 'Sorry, you are not allowed to do that.' ), array( 'status' => 403 ) );
    }
    $user_id = $request->get_param( 'user_id' );
    $user_data = get_userdata( $user_id );
    return rest_ensure_response( $user_data );
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with UsersWP plugin version <= 1.2.47 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable REST API endpoint (e.g., /wp-json/userswp/v1/user-data).
2. Send a GET request with a target user ID:

   curl -X GET "http://target.com/wp-json/userswp/v1/user-data?user_id=1"
   

3. If successful, the response will contain user data (e.g., email, display name).

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual requests to /wp-json/userswp/v1/* endpoints from unauthenticated sources.
• Look for patterns of user ID enumeration (sequential IDs in requests).

Hunting:

• Search web server logs for GET /wp-json/userswp/v1/user-data with no preceding authentication.
• Use the Sigma rule below to detect such activity.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-json/userswp/v1/user-data with parameter user_id
• Logs: Web server access logs showing 200 responses to unauthenticated REST API calls to UsersWP endpoints
• File: Presence of UsersWP plugin version 1.2.47 or earlier in /wp-content/plugins/userswp/

Detection Engineering

YARA Rule

rule Detect_UsersWP_Missing_Auth_CVE_2025_66072 {
    meta:
        description = "Detects exploitation attempts for CVE-2025-66072 in UsersWP plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66072"
    strings:
        $endpoint = "/wp-json/userswp/v1/user-data"
        $param = "user_id="
    condition:
        any of them
}

Sigma Rule

title: UsersWP Missing Authorization Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to UsersWP REST API endpoints
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/wp-json/userswp/v1/user-data'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate authenticated admin requests (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66072 UsersWP Missing Authorization Exploit"; flow:to_server,established; content:"GET"; http_method; content:"/wp-json/userswp/v1/user-data"; http_uri; content:"user_id="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the UsersWP plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to /wp-json/userswp/v1/*.
3. Restrict access to the REST API using IP whitelisting or authentication plugins.

Long-term Fix:

• Monitor the plugin’s official page for updates and apply the patch as soon as it becomes available.
• Consider replacing the plugin with an alternative that has active security maintenance.

Workaround:

• Add the following code to the theme’s functions.php to block unauthenticated access to the vulnerable endpoint:

add_filter( 'rest_pre_dispatch', function( $result, $server, $request ) {
    if ( strpos( $request->get_route(), '/userswp/v1/' ) !== false && ! is_user_logged_in() ) {
        return new WP_Error( 'rest_not_logged_in', 'You must be logged in.', array( 'status' => 401 ) );
    }
    return $result;
}, 10, 3 );

Valters IT
Securing Digital Frontiers