CVE-2025-66112

Executive Summary

CVE-2025-66112 is a Missing Authorization vulnerability in the WordPress plugin Accessibility Toolkit by WebYes (slug: accessibility-plus), developed by WebToffee. The flaw affects all versions up to and including 2.0.4. An unauthenticated attacker can exploit incorrectly configured access control security levels to perform unauthorized actions, leading to low confidentiality impact. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code has been released. As this is a WordPress plugin vulnerability, the attack surface is limited to sites running the affected plugin.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is not open-source in the traditional sense; however, the code is publicly accessible. The lack of a patch from the vendor increases supply chain risk for organizations using this plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The low EPSS score and absence of public exploits reduce immediate risk, but the missing authorization could be chained with other vulnerabilities.

Deep Dive & Mechanics

The vulnerability stems from improper implementation of capability checks in the plugin's AJAX handlers and REST API endpoints. The plugin fails to verify that the current user has the required permissions (e.g., manage_options or edit_posts) before executing sensitive operations. This allows any unauthenticated visitor to trigger functions that should be restricted to administrators.

Key affected components include:

• AJAX actions registered via wp_ajax_ and wp_ajax_nopriv_ hooks.
• REST API routes that lack permission_callback validation.
• Shortcode handlers that execute database queries or file operations without nonce or capability checks.

An attacker can send crafted HTTP requests to endpoints like /wp-admin/admin-ajax.php?action=accessibility_plus_save_settings with arbitrary parameters, potentially modifying plugin settings or accessing stored data.

Vulnerable vs. Patched Code

Vulnerable Code (accessibility-plus.php, line ~245):

add_action('wp_ajax_nopriv_accessibility_plus_save_settings', 'accessibility_plus_save_settings');
function accessibility_plus_save_settings() {
    // No capability check
    update_option('accessibility_plus_settings', $_POST['settings']);
    wp_die();
}

Patched Code (hypothetical fix):

add_action('wp_ajax_accessibility_plus_save_settings', 'accessibility_plus_save_settings');
function accessibility_plus_save_settings() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    check_ajax_referer('accessibility_plus_nonce', 'nonce');
    update_option('accessibility_plus_settings', $_POST['settings']);
    wp_die();
}

The patch adds a capability check (current_user_can('manage_options')) and a nonce verification to prevent unauthorized access.

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify WordPress sites using the plugin via Shodan dorks or WPScan.
2. Exploit: Send a crafted POST request to the vulnerable AJAX endpoint:

   curl -X POST http://target/wp-admin/admin-ajax.php \
     -d "action=accessibility_plus_save_settings&settings[theme]=dark"
   

3. Post-Exploitation: Modify plugin settings to inject malicious JavaScript (if stored settings are rendered unsanitized) or exfiltrate data.

Blue Team

1. Detection: Monitor for unusual AJAX requests to admin-ajax.php with action parameters containing accessibility_plus.
2. Honeypot: Deploy a decoy WordPress instance with the vulnerable plugin and log all requests.
3. Mitigation: Disable the plugin immediately if no patch is available. Use a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=accessibility_plus_* from unauthenticated users.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=accessibility_plus_* parameters.
• File: Modified wp_options table entries with option_name = 'accessibility_plus_settings'.
• Log: WordPress debug log entries showing wp_ajax_nopriv_accessibility_plus_* actions triggered by non-admin IPs.

Detection Engineering

YARA Rule

rule CVE_2025_66112_WordPress_Plugin {
    meta:
        description = "Detects exploitation attempts for CVE-2025-66112 in Accessibility Toolkit plugin"
        author = "Valters IT"
        date = "2025-02-20"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-66112"
    strings:
        $ajax_action = "accessibility_plus_" ascii wide nocase
        $nopriv = "wp_ajax_nopriv_" ascii wide nocase
    condition:
        $ajax_action and $nopriv
}

Sigma Rule

title: CVE-2025-66112 Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests targeting the vulnerable AJAX endpoint of Accessibility Toolkit plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=accessibility_plus_'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66112 - Accessibility Toolkit Missing Authorization Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=accessibility_plus_"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Accessibility Toolkit by WebYes plugin until a patch is released.
2. Short-term: Implement a WAF rule to block unauthenticated requests to admin-ajax.php with action parameters starting with accessibility_plus_.
3. Long-term: Monitor the vendor's website for updates. Consider replacing the plugin with an alternative that has active security maintenance.
4. Compromise Assessment: Review WordPress logs for any unauthorized AJAX calls and check the wp_options table for unexpected accessibility_plus_settings entries.

Valters IT
DevSecOps & Cyber Threat Intelligence