CVE-2025-66143

Executive Summary

CVE-2025-66143 is a Missing Authorization vulnerability in the Crumber WordPress plugin by Merkulove, affecting versions up to and including 1.0.10. This flaw allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification. The vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx misconfigurations. With a CVSS score of 5.4 (Medium), the risk is elevated due to the ease of exploitation and the lack of a vendor patch. No public proof-of-concept (PoC) or exploit code has been released, but the vulnerability is actively monitored.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to verify the integrity of their plugin installations and consider removing or replacing the plugin if no patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low complexity and the ability for authenticated attackers to exploit the missing authorization checks without user interaction.

Deep Dive & Mechanics

The vulnerability resides in the crumber-elementor plugin's access control mechanisms. The plugin fails to properly validate user capabilities when processing certain AJAX actions or REST API endpoints. Specifically, the check_admin_referer() or current_user_can() functions are either missing or incorrectly implemented, allowing any authenticated user (e.g., subscribers) to perform actions intended for administrators or editors.

Root Cause: The plugin uses wp_ajax_* hooks without verifying the required user role or capability. For example, a function like crumber_save_settings() may be hooked to wp_ajax_crumber_save_settings but lacks a capability check such as if (!current_user_can('manage_options')) wp_die('Unauthorized');.

Attack Vector: An authenticated attacker sends crafted HTTP requests to the vulnerable endpoints, bypassing authorization checks to read or modify plugin settings, user data, or other sensitive information.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.0.10):

add_action('wp_ajax_crumber_save_settings', 'crumber_save_settings');
function crumber_save_settings() {
    // Missing capability check
    update_option('crumber_settings', $_POST['settings']);
    wp_send_json_success();
}

Patched Code (hypothetical):

add_action('wp_ajax_crumber_save_settings', 'crumber_save_settings');
function crumber_save_settings() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    update_option('crumber_settings', $_POST['settings']);
    wp_send_json_success();
}

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Authenticated WordPress user account (e.g., subscriber).
2. Steps:
   • Log in to WordPress.
   • Identify vulnerable AJAX endpoints (e.g., admin-ajax.php?action=crumber_save_settings).
   • Craft a POST request with malicious payload:

     curl -X POST 'http://target/wp-admin/admin-ajax.php' \
       -H 'Cookie: wordpress_logged_in_xxx=...' \
       -d 'action=crumber_save_settings&settings[malicious]=data'
     

   • Verify unauthorized access to settings or data.

Blue Team (Detection & Hardening)

1. Detection:
   • Monitor for unusual AJAX requests to admin-ajax.php with action parameters starting with crumber_.
   • Alert on requests from low-privilege users to administrative endpoints.
2. Hardening:
   • Disable or remove the Crumber plugin until a patch is available.
   • Implement Web Application Firewall (WAF) rules to block requests to vulnerable endpoints.
   • Enforce least privilege for all WordPress users.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action=crumber_* parameters.
  • Unusual settings parameters in POST body.
• File IOCs:
  • Modified wp_options table entries with crumber_settings option name.
  • Presence of unexpected files in /wp-content/plugins/crumber-elementor/.
• Log IOCs:
  • WordPress debug logs showing failed capability checks or unauthorized access attempts.

Detection Engineering

YARA Rule

rule CVE_2025_66143_Crumber_Missing_Auth {
    meta:
        description = "Detects missing authorization in Crumber WordPress plugin"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-66143"
    strings:
        $s1 = "crumber_save_settings" nocase
        $s2 = "crumber_elementor" nocase
        $s3 = "current_user_can" nocase
    condition:
        all of ($s1, $s2) and not $s3
}

Sigma Rule

title: CVE-2025-66143 Crumber Missing Authorization
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of missing authorization in Crumber plugin
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=crumber_'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66143 Crumber Missing Authorization Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-ajax.php"; http.client_body; content:"action=crumber_"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:
   • Remove or disable the Crumber plugin (wp-content/plugins/crumber-elementor/).
   • Review and revoke any suspicious user accounts.
2. Long-term Fix:
   • Apply vendor patch if released; otherwise, replace the plugin with a secure alternative.
   • Implement capability checks in custom WordPress plugins.
3. Monitoring:
   • Enable WordPress audit logging.
   • Deploy WAF rules to block known attack patterns.

Valters IT
Securing Digital Frontiers