CVE-2025-66145

Executive Summary

CVE-2025-66145 is a Missing Authorization vulnerability in the Worker for WPBakery WordPress plugin, developed by Merkulove. This plugin is designed to extend the functionality of the WPBakery page builder. The vulnerability affects all versions up to and including 1.1.1. It allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification. The vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx.

The CVSS score is 5.4 (Medium), with a network attack vector and low complexity. No public proof-of-concept (PoC) or exploit code is currently available, and the patch status remains unknown. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain attacks have been reported for this plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited unauthorized data access.
• Integrity (I): Low (L) – Limited unauthorized data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability is easy to exploit but has limited impact. However, it could be chained with other vulnerabilities for more severe attacks.

Deep Dive & Mechanics

The vulnerability resides in the Worker for WPBakery plugin, which likely adds custom post types, AJAX handlers, or REST API endpoints. The missing authorization check means that certain functions or endpoints do not verify if the requesting user has the necessary permissions (e.g., manage_options or edit_posts).

Root Cause: The plugin fails to implement capability checks (e.g., current_user_can()) before executing privileged actions. This allows any unauthenticated user to trigger these actions.

Attack Vector: An attacker can send crafted HTTP requests to the vulnerable endpoint(s) without authentication. For example, if the plugin registers an AJAX action like wp_ajax_nopriv_worker_wpbakery_action, it may be accessible to unauthenticated users.

Impact: The attacker could:

• Read sensitive data (e.g., configuration files, user data).
• Modify plugin settings or content.
• Potentially escalate privileges if combined with other vulnerabilities.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical example of the vulnerable code and a potential fix.

Vulnerable Code (PHP):

add_action('wp_ajax_nopriv_worker_wpbakery_action', 'worker_wpbakery_handle_action');
function worker_wpbakery_handle_action() {
    // No capability check
    $data = $_POST['data'];
    update_option('worker_wpbakery_settings', $data);
    wp_send_json_success();
}

Patched Code (Hypothetical):

add_action('wp_ajax_worker_wpbakery_action', 'worker_wpbakery_handle_action');
add_action('wp_ajax_nopriv_worker_wpbakery_action', 'worker_wpbakery_handle_action_nopriv');
function worker_wpbakery_handle_action() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $data = $_POST['data'];
    update_option('worker_wpbakery_settings', $data);
    wp_send_json_success();
}
function worker_wpbakery_handle_action_nopriv() {
    wp_die('Unauthorized', 403);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Worker for WPBakery <= 1.1.1 installed and activated.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns include:
   • /wp-admin/admin-ajax.php?action=worker_wpbakery_*
   • Custom REST API routes like /wp-json/worker-wpbakery/v1/*
2. Send a crafted request without authentication:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
        -d "action=worker_wpbakery_action&data=malicious_value"
   

3. Observe the response. If successful, the attacker can manipulate plugin data.

Note: No public exploit code is available. The above is a generic example.

Blue Team (Defensive)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with unknown actions.
• Look for requests to custom REST endpoints without authentication.
• Check for unexpected changes to plugin options or settings.

Hunting:

• Search logs for worker_wpbakery in request URIs.
• Use the Sigma rule below to detect exploitation attempts.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available – plugin files may vary)
• Suspicious URLs:
  • /wp-admin/admin-ajax.php?action=worker_wpbakery_*
  • /wp-json/worker-wpbakery/v1/*
• Log Entries:
  • POST /wp-admin/admin-ajax.php with action=worker_wpbakery_* from unauthenticated users.
• Network Patterns:
  • Repeated requests to the same endpoint with varying parameters.

Detection Engineering

YARA Rule

rule CVE_2025_66145_Worker_WPBakery {
    meta:
        description = "Detects missing authorization in Worker for WPBakery plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-66145"
    strings:
        $vuln_func = "wp_ajax_nopriv_worker_wpbakery" nocase
        $vuln_hook = "worker_wpbakery_handle_action" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-66145 - Missing Authorization in Worker for WPBakery
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of missing authorization in Worker for WPBakery plugin
author: Valters IT
date: 2025/04/10
tags:
    - cve.2025.66145
    - attack.t1190
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=worker_wpbakery'
    condition: selection
falsepositives:
    - Legitimate plugin usage by authorized users
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-66145 - Missing Authorization in Worker for WPBakery";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"action=worker_wpbakery"; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests containing worker_wpbakery in the URI.
3. Monitor logs for suspicious activity related to this plugin.

Long-term Fix:

• The vendor must release a patched version that adds proper capability checks (e.g., current_user_can('manage_options')) to all AJAX and REST endpoints.
• Users should update to the latest version once available.

Workaround:

• Add the following code to the theme's functions.php to block unauthenticated access:

  add_action('init', function() {
      if (defined('DOING_AJAX') && DOING_AJAX) {
          if (strpos($_REQUEST['action'], 'worker_wpbakery') !== false && !is_user_logged_in()) {
              wp_die('Unauthorized', 403);
          }
      }
  });
  

Valters IT
Securing Digital Frontiers