CVE-2025-66077

Executive Summary

CVE-2025-66077 is a Missing Authorization vulnerability in the wpWax Legal Pages WordPress plugin, affecting versions from n/a through 1.4.6. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially exposing sensitive legal page configurations or metadata. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept (PoC) or patch is currently available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Organizations using the Legal Pages plugin should treat this as a supply chain risk, as the plugin may be bundled in themes or managed WordPress environments. No known malicious packages have been identified, but the lack of a patch increases the risk of future exploitation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No service disruption.

Threat Level: Medium. The vulnerability is easy to exploit but only leads to low confidentiality impact. However, in a WordPress context, exposed legal page data could include sensitive business terms or privacy policy drafts.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the legal-pages plugin’s REST API endpoints or AJAX handlers. The plugin likely exposes functions to retrieve, create, or modify legal page templates without verifying the user’s capabilities (e.g., manage_options or edit_posts). An unauthenticated attacker can send crafted HTTP requests to these endpoints to access or manipulate legal page data.

Root Cause: The plugin fails to call current_user_can() or similar WordPress capability checks before executing sensitive operations. This is a classic CWE-862 (Missing Authorization) issue.

Attack Vector: The attacker sends a GET or POST request to a vulnerable endpoint (e.g., /wp-json/legal-pages/v1/templates or an admin-ajax action). Since no authentication is required, the server processes the request and returns data.

Impact: An attacker could enumerate legal page templates, retrieve privacy policy content, or potentially modify settings if write operations are also unprotected. This could lead to defacement or disclosure of confidential legal information.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin’s main PHP files (e.g., legal-pages.php or includes/class-legal-pages-api.php). A typical vulnerable pattern:

// Vulnerable: No capability check
add_action('wp_ajax_nopriv_legal_pages_get_template', 'legal_pages_get_template');
function legal_pages_get_template() {
    $template_id = $_GET['template_id'];
    $template = get_post($template_id);
    echo json_encode($template);
    wp_die();
}

A patched version would include:

// Patched: Check user capability
add_action('wp_ajax_legal_pages_get_template', 'legal_pages_get_template');
function legal_pages_get_template() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $template_id = $_GET['template_id'];
    $template = get_post($template_id);
    echo json_encode($template);
    wp_die();
}

Note: The nopriv prefix in the vulnerable code allows unauthenticated access.

Exploitation & Lab Setup

Red Team

Prerequisites: A WordPress site with Legal Pages plugin version <= 1.4.6.

Exploitation Steps:

1. Enumerate Endpoints: Use a tool like curl or Burp Suite to discover vulnerable endpoints. Common patterns include:

   • /wp-json/legal-pages/v1/templates
   • /wp-admin/admin-ajax.php?action=legal_pages_get_template&template_id=1

2. Craft Request: Send an unauthenticated GET request to retrieve legal page data.

curl -v "http://target.com/wp-json/legal-pages/v1/templates"

3. Extract Data: If successful, the response will contain JSON with legal page content.

Expected Output: A JSON array of legal page objects, including post titles, content, and metadata.

Blue Team

Detection: Monitor for unusual requests to plugin-specific endpoints from unauthenticated IPs. Look for patterns like:

• Requests to /wp-json/legal-pages/ without a valid nonce or authentication cookie.
• High volume of requests to admin-ajax.php with action=legal_pages_* parameters.

Honeypot: Deploy a fake legal page endpoint that returns a decoy response and logs the attacker’s IP.

Blocking: Use a Web Application Firewall (WAF) to block requests to known vulnerable paths unless they include a valid authentication token.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-json/legal-pages/v1/templates from unauthenticated sources.
  • POST requests to /wp-admin/admin-ajax.php with action=legal_pages_* and no _wpnonce parameter.
• File IOCs:
  • Presence of the legal-pages plugin directory in /wp-content/plugins/legal-pages/.
  • Plugin version string 1.4.6 in the plugin header.
• Log IOCs:
  • WordPress debug log entries showing wp_ajax_nopriv_legal_pages_* actions.
  • Web server access logs with 200 responses to /wp-json/legal-pages/v1/templates from unknown IPs.

Detection Engineering

YARA Rule

rule wpwax_legal_pages_missing_auth {
    meta:
        description = "Detects CVE-2025-66077 exploitation attempts in web logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66077"
    strings:
        $endpoint1 = "/wp-json/legal-pages/v1/templates"
        $endpoint2 = "action=legal_pages_get_template"
        $endpoint3 = "action=legal_pages_save_template"
    condition:
        any of ($endpoint*) and not http_user_agent contains "WordPress"
}

Sigma Rule

title: CVE-2025-66077 - Missing Authorization in wpWax Legal Pages
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects unauthenticated access to Legal Pages plugin endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/wp-json/legal-pages/v1/"
            - "action=legal_pages_"
    condition: selection
falsepositives:
    - Legitimate admin requests with valid nonce
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66077 - wpWax Legal Pages Missing Authorization Attempt"; flow:to_server; content:"/wp-json/legal-pages/v1/"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential for business operations.
2. Apply virtual patching via WAF rules to block unauthenticated requests to /wp-json/legal-pages/ and admin-ajax.php?action=legal_pages_*.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor (wpWax) must release a patched version that adds capability checks to all AJAX and REST endpoints. Until then, consider replacing the plugin with an alternative legal page solution.

Workaround:

• Add the following code to the theme’s functions.php to block unauthenticated access:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX && !is_user_logged_in()) {
        $action = $_REQUEST['action'] ?? '';
        if (strpos($action, 'legal_pages_') === 0) {
            wp_die('Unauthorized', 403);
        }
    }
});

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All intelligence is based on publicly available data and should be verified before action.