CVE-2025-66110

Executive Summary

CVE-2025-66110 is a Missing Authorization vulnerability in the bPlugins Tiktok Feed WordPress plugin (slug: b-tiktok-feed). This flaw allows unauthenticated attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data exposure or manipulation. The vulnerability affects all versions up to and including 1.0.23. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild, but the risk remains due to the lack of authentication requirements.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the WordPress dashboard or via direct download are affected. No known supply chain compromise has been reported, but the absence of a patch increases the risk of malicious actors leveraging this flaw in targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to low confidentiality loss. However, in a WordPress context, this could lead to exposure of sensitive TikTok feed data or internal plugin configurations.

Deep Dive & Mechanics

The vulnerability stems from a Missing Authorization check (CWE-862) in the plugin's REST API endpoints or AJAX handlers. The plugin likely exposes functionality to fetch or manage TikTok feeds without verifying user capabilities (e.g., manage_options or edit_posts). An unauthenticated attacker can send crafted HTTP requests to trigger these endpoints, potentially retrieving feed data, modifying settings, or accessing other protected resources.

The plugin uses WordPress's built-in AJAX API, but fails to call current_user_can() or similar authorization functions before processing requests. This allows any visitor to the site to interact with the plugin's backend functions.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is hypothesized based on common WordPress plugin mistakes:

Vulnerable Code (hypothetical):

add_action('wp_ajax_nopriv_bttf_fetch_feed', 'bttf_fetch_feed');
function bttf_fetch_feed() {
    // No authorization check
    $feed_data = get_option('bttf_feed_cache');
    wp_send_json_success($feed_data);
}

Patched Code (hypothetical):

add_action('wp_ajax_nopriv_bttf_fetch_feed', 'bttf_fetch_feed');
function bttf_fetch_feed() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 401);
    }
    $feed_data = get_option('bttf_feed_cache');
    wp_send_json_success($feed_data);
}

The patch adds a capability check (manage_options) to ensure only administrators can access the endpoint.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with b-tiktok-feed plugin <= 1.0.23
• Network access to the site

Exploitation Steps:

1. Identify the vulnerable endpoint by analyzing the plugin's JavaScript or PHP files. Common endpoints include:
   • /wp-admin/admin-ajax.php?action=bttf_fetch_feed
   • /wp-json/bttf/v1/feed
2. Send a crafted HTTP request without authentication:

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
        -d "action=bttf_fetch_feed"
   

3. If successful, the response will contain sensitive feed data or configuration details.

No public exploit code is available. The above is a generic example based on the vulnerability type.

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions prefixed bttf_ from unauthenticated users.
• Look for HTTP 200 responses to these requests without prior login.

Hunting:

• Search logs for action=bttf_ in query strings.
• Check for unexpected access to /wp-json/bttf/ endpoints.

Lab Setup:

1. Install WordPress on a local server (e.g., using Docker).
2. Install b-tiktok-feed plugin version 1.0.23.
3. Configure a test TikTok feed.
4. Use Burp Suite or curl to send unauthenticated requests to the plugin's endpoints.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to /wp-admin/admin-ajax.php with action=bttf_* parameters from IPs not associated with authenticated users.
  • Requests to /wp-json/bttf/v1/* without a valid nonce or authentication token.

• File:

  • Modified plugin files (e.g., wp-content/plugins/b-tiktok-feed/) with unauthorized changes.
  • Unexpected entries in wp_options table related to bttf_ options.

• Log:

  • Repeated 200 responses to admin-ajax.php with action=bttf_ from the same IP.
  • Absence of wp_die() or wp_send_json_error() calls in plugin logs.

Detection Engineering

YARA Rule

rule CVE_2025_66110_WordPress_TikTok_Feed {
    meta:
        description = "Detects exploitation attempts for CVE-2025-66110 in b-tiktok-feed plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66110"
    strings:
        $ajax_action = "action=bttf_" ascii wide nocase
        $rest_route = "/bttf/v1/" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-66110 - Missing Authorization in b-tiktok-feed
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated access to b-tiktok-feed plugin endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "action=bttf_"
            - "/bttf/v1/"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate plugin updates or admin actions
level: medium

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2025-66110 - Missing Authorization in b-tiktok-feed";
    flow:to_server,established;
    content:"action=bttf_"; http_uri;
    content:"/bttf/v1/"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-66110;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests containing action=bttf_ or /bttf/v1/ from unauthenticated users.
3. Restrict access to admin-ajax.php using .htaccess or server-level rules for non-admin IPs.

Long-term Fix:

• Monitor the plugin's repository for updates. Once patched, update to version > 1.0.23.
• Apply the principle of least privilege to all WordPress plugins by auditing their AJAX and REST API endpoints.

Workaround:

• Add a custom function to your theme's functions.php to enforce authorization:

  add_action('wp_ajax_nopriv_bttf_fetch_feed', function() {
      wp_die('Unauthorized', 401);
  }, 1);
  

Valters IT
Securing Digital Frontiers