CVE-2025-66142

Executive Summary

CVE-2025-66142 is a Missing Authorization vulnerability in the Comparimager for Elementor WordPress plugin, developed by Merkulove. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification. The vulnerability affects all versions from n/a through 1.0.1. As a WordPress plugin, this issue is specific to the WordPress ecosystem and does not involve Apache or Nginx server software.

The vulnerability has a CVSS score of 5.4 (Medium), with an EPSS probability of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept (PoC) code or patch is currently available.

Supply Chain & Package Security

This vulnerability is part of the WordPress plugin supply chain. Users who have installed the Comparimager for Elementor plugin from the WordPress plugin repository or directly from Merkulove are affected. The lack of a patch means that the plugin remains vulnerable, and users must rely on alternative mitigations such as disabling the plugin or implementing web application firewall (WAF) rules.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthorized access to sensitive data or limited modification of content, but does not lead to full system compromise or denial of service.

Deep Dive & Mechanics

The vulnerability stems from a Missing Authorization check (CWE-862) in the Comparimager for Elementor plugin. The plugin likely exposes REST API endpoints or AJAX actions that perform sensitive operations (e.g., reading or modifying comparison data) without verifying that the requesting user has the appropriate permissions. An unauthenticated attacker can send crafted HTTP requests to these endpoints to exploit the flaw.

The affected component is the comparimager-elementor plugin, which integrates with Elementor page builder to provide image comparison functionality. The missing authorization allows attackers to:

• Access comparison data that should be restricted to authenticated users.
• Modify or delete comparison settings or data.

The vulnerability is triggered by sending a request to a vulnerable endpoint without proper nonce or capability checks.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison cannot be provided. However, the vulnerable code likely resembles:

// Vulnerable: No permission check
add_action('wp_ajax_nopriv_comparimager_get_data', 'comparimager_get_data');
function comparimager_get_data() {
    // Process request without checking user capabilities
    $data = get_option('comparimager_settings');
    wp_send_json_success($data);
}

A patched version would include:

// Patched: Check user capabilities
add_action('wp_ajax_comparimager_get_data', 'comparimager_get_data');
add_action('wp_ajax_nopriv_comparimager_get_data', 'comparimager_get_data_noauth');
function comparimager_get_data() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $data = get_option('comparimager_settings');
    wp_send_json_success($data);
}
function comparimager_get_data_noauth() {
    wp_die('Unauthorized', 403);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Comparimager for Elementor plugin version <= 1.0.1 installed and activated.
• Network access to the target site.

Exploitation Steps:

1. Identify vulnerable endpoints by analyzing the plugin's JavaScript or PHP files. Common patterns include wp_ajax_nopriv_* actions.
2. Send a crafted HTTP request to the vulnerable endpoint. For example:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   
   action=comparimager_get_data
   

3. If the endpoint returns sensitive data without authentication, the exploit is successful.

Example cURL command:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -d "action=comparimager_get_data"

Blue Team

Detection Steps:

1. Monitor for unusual requests to /wp-admin/admin-ajax.php with unknown or suspicious action parameters.
2. Look for requests that do not include a valid nonce or authentication token.
3. Check server logs for 403 errors that may indicate failed exploitation attempts.

Honeypot Setup:

• Deploy a fake endpoint that mimics the vulnerable action and logs all requests for analysis.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=comparimager_* parameters from unauthenticated sources.
  • Repeated 403 responses from the same IP address.

• File IOCs:

  • Presence of the plugin directory: /wp-content/plugins/comparimager-elementor/
  • Modified or unexpected files in the plugin directory.

• Log IOCs:

  • Access log entries showing POST /wp-admin/admin-ajax.php with action=comparimager_* and no valid session cookie.

Detection Engineering

YARA Rule

rule Detect_Comparimager_Missing_Auth {
    meta:
        description = "Detects attempts to exploit CVE-2025-66142 in Comparimager for Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66142"
    strings:
        $action = "comparimager_" ascii wide nocase
        $ajax = "admin-ajax.php" ascii wide nocase
    condition:
        $ajax and $action
}

Sigma Rule

title: Exploitation Attempt for CVE-2025-66142
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests targeting the Comparimager for Elementor plugin's missing authorization vulnerability
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=comparimager_'
    condition: selection
falsepositives:
    - Legitimate plugin usage by authenticated users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66142 - Comparimager for Elementor Missing Authorization Exploit"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=comparimager_"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical for business operations.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action parameters starting with comparimager_ from unauthenticated users.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Since no patch is available, consider replacing the plugin with an alternative that provides similar functionality and is actively maintained.
• Contact the vendor (Merkulove) for an update on patch availability.

Workaround:

• Add the following .htaccess rule to block unauthenticated access to the vulnerable endpoints:

  RewriteEngine On
  RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$
  RewriteCond %{QUERY_STRING} action=comparimager_ [NC]
  RewriteCond %{HTTP_COOKIE} !wordpress_logged_in_ [NC]
  RewriteRule .* - [F,L]
  

Valters IT