CVE-2025-66144

Executive Summary

CVE-2025-66144 is a Missing Authorization vulnerability in the Worker for Elementor WordPress plugin, developed by Merkulove. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification. The vulnerability affects all versions up to and including 1.0.10. As a WordPress plugin vulnerability, it is part of the broader WordPress ecosystem and does not involve Apache or Nginx directly. The CVSS score is 5.4 (Medium), and no public proof-of-concept (PoC) or patch is currently available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is Medium due to the low complexity and no required privileges, but the impact is limited to low confidentiality and integrity loss.

Deep Dive & Mechanics

The vulnerability stems from a Missing Authorization check (CWE-862) in the worker-elementor plugin. The plugin likely exposes AJAX actions or REST endpoints that perform sensitive operations (e.g., reading or modifying Elementor data) without verifying the user's capabilities or authentication status. An attacker can send crafted HTTP requests to these endpoints to bypass access controls.

Root Cause: The plugin fails to call current_user_can() or similar WordPress capability checks before executing privileged actions. This allows any unauthenticated visitor to trigger functions intended only for administrators or authenticated users.

Attack Vector: The attacker sends a direct HTTP request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=worker_elementor_export) without any authentication token.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable pattern. A typical vulnerable code snippet might look like:

// Vulnerable: No capability check
add_action('wp_ajax_nopriv_worker_elementor_export', 'worker_export_data');
function worker_export_data() {
    // Sensitive operation
    $data = get_option('worker_elementor_settings');
    wp_send_json($data);
}

A patched version would include:

// Patched: Capability check added
add_action('wp_ajax_worker_elementor_export', 'worker_export_data');
function worker_export_data() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $data = get_option('worker_elementor_settings');
    wp_send_json($data);
}

Note: The nopriv prefix in the vulnerable version allows unauthenticated access.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Identify Target: Scan for WordPress sites using the plugin (e.g., via Shodan dorks).
2. Enumerate Endpoints: Use a tool like Burp Suite or curl to probe for vulnerable AJAX actions. Common actions might include worker_elementor_export, worker_elementor_import, or worker_elementor_save.
3. Craft Exploit: Send a POST request to /wp-admin/admin-ajax.php with the action parameter.

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=worker_elementor_export" \
  -H "Content-Type: application/x-www-form-urlencoded"

4. Verify: If successful, the response will contain sensitive data (e.g., Elementor templates, settings).

Blue Team (Detection & Response)

• Monitor for unusual AJAX requests to /wp-admin/admin-ajax.php with unknown or suspicious actions.
• Check for requests lacking a valid X-WP-Nonce header or WordPress authentication cookies.
• Use the detection rules below to identify exploitation attempts.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=worker_elementor_* parameters from unauthenticated sources.
• File: Presence of the plugin directory /wp-content/plugins/worker-elementor/ with version <= 1.0.10.
• Log: WordPress debug logs showing wp_ajax_nopriv_* hooks being triggered for sensitive actions.

Detection Engineering

YARA Rule

rule CVE_2025_66144_Worker_Elementor {
    meta:
        description = "Detects vulnerable Worker for Elementor plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66144"
    strings:
        $vuln_hook = "wp_ajax_nopriv_worker_elementor" nocase
        $vuln_func = "function worker_elementor_" nocase
    condition:
        $vuln_hook or $vuln_func
}

Sigma Rule

title: CVE-2025-66144 - Missing Authorization in Worker for Elementor
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts against the missing authorization vulnerability in Worker for Elementor plugin.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=worker_elementor_'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-66144 - Worker for Elementor Missing Authorization Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=worker_elementor_"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the Worker for Elementor plugin until a patch is released.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block requests containing action=worker_elementor_ in the POST body.
3. Long-term: Monitor the vendor's website for a patched version (>= 1.0.11). Apply the update as soon as it becomes available.
4. Alternative: If the plugin is critical, consider replacing it with a similar, actively maintained plugin that has proper authorization checks.

Valters IT
Securing Digital Frontiers