CVE-2025-66137

Executive Summary

CVE-2025-66137 is a Missing Authorization vulnerability in the Searcher for Elementor WordPress plugin by Merkulove, affecting versions up to and including 1.0.3. This flaw allows unauthenticated attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification. The vulnerability resides in the plugin's failure to properly validate user permissions before executing sensitive operations, making it a critical issue for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and potentially through third-party marketplaces. Since the patch status is UNKNOWN, users must consider the plugin as potentially compromised. The lack of a patch increases supply chain risk, as attackers may target outdated installations. Administrators should immediately audit their WordPress environments for this plugin and consider disabling it until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The low EPSS score (0.0%) suggests limited active exploitation in the wild, but the ease of exploitation (no authentication required) makes it a high-priority target for automated scanning.

Deep Dive & Mechanics

The vulnerability stems from the plugin's failure to enforce proper authorization checks on certain AJAX actions or REST endpoints. In WordPress plugins, missing authorization (CWE-862) occurs when a function or endpoint does not verify that the current user has the required capabilities before performing an action. In this case, the searcher-elementor plugin likely exposes functionality that should be restricted to administrators but is accessible to any unauthenticated user.

The plugin's code may use wp_ajax_* hooks without a corresponding wp_ajax_nopriv_* check, or it may fail to call current_user_can() or wp_verify_nonce() before processing requests. This allows attackers to send crafted HTTP requests to trigger actions such as modifying plugin settings, accessing search logs, or retrieving sensitive data.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable pattern. A typical vulnerable code snippet might look like:

// Vulnerable: No permission check
add_action('wp_ajax_searcher_save_settings', 'searcher_save_settings');
function searcher_save_settings() {
    update_option('searcher_settings', $_POST['settings']);
    wp_die();
}

A patched version would include:

// Patched: Permission check added
add_action('wp_ajax_searcher_save_settings', 'searcher_save_settings');
function searcher_save_settings() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    check_admin_referer('searcher_nonce');
    update_option('searcher_settings', $_POST['settings']);
    wp_die();
}

The patched code adds current_user_can('manage_options') to restrict access to administrators and check_admin_referer() to prevent CSRF.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would send a crafted HTTP request to the WordPress site. Since no public exploit code is available, we provide a generic proof-of-concept:

# Example: Exploit missing authorization to retrieve plugin settings
curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
  -d "action=searcher_get_settings" \
  -H "User-Agent: Mozilla/5.0"

If the endpoint returns sensitive data without authentication, the vulnerability is confirmed. Attackers could also attempt to modify settings:

# Example: Modify plugin settings without authorization
curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
  -d "action=searcher_save_settings&settings[api_key]=attacker_key" \
  -H "User-Agent: Mozilla/5.0"

Blue Team

To detect exploitation attempts, monitor for unusual AJAX requests to admin-ajax.php with actions containing "searcher" from unauthenticated sources. Set up alerts for:

• Requests to admin-ajax.php with action=searcher_* parameters from IPs not in the admin whitelist.
• Multiple failed login attempts followed by AJAX requests to the plugin's endpoints.
• Changes to the searcher_settings option in the WordPress database.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action=searcher_* parameters.
  • Unusual User-Agent strings or repeated requests from the same IP.
• File IOCs:
  • Modified plugin files in /wp-content/plugins/searcher-elementor/.
  • Unexpected entries in WordPress options table (searcher_settings).
• Log IOCs:
  • WordPress debug log entries showing unauthorized access attempts.
  • Web server access logs with 200 responses to admin-ajax.php from unauthenticated users.

Detection Engineering

YARA Rule

rule Detect_Searcher_Elementor_Missing_Auth {
    meta:
        description = "Detects missing authorization in Searcher for Elementor plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-66137"
    strings:
        $vuln_func = "add_action('wp_ajax_" nocase
        $no_check = "current_user_can" nocase
    condition:
        $vuln_func and not $no_check
}

Sigma Rule

title: Searcher for Elementor Missing Authorization Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-66137
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=searcher_'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66137 Searcher for Elementor Missing Authorization"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=searcher_"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Since no official patch is available, immediate actions include:

1. Disable the plugin until a patch is released by Merkulove.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=searcher_* parameters from unauthenticated users.
3. Monitor WordPress logs for unauthorized access attempts.
4. Apply virtual patching using a security plugin like Wordfence or Sucuri to block exploitation.
5. Audit user roles and ensure no unauthorized users have administrative capabilities.
6. Consider replacing the plugin with an alternative that has proper authorization checks.

Valters IT
Securing Digital Frontiers