CVE-2025-66151

Executive Summary

CVE-2025-66151 is a Missing Authorization vulnerability in the Merkulove Countdowner for Elementor WordPress plugin (slug: countdowner-elementor), affecting versions from n/a through 1.0.4. This flaw allows an authenticated attacker with low privileges (e.g., subscriber) to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification of countdown settings. The vulnerability is classified as a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). No public proof-of-concept (PoC) or exploit code is available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to verify the integrity of the plugin files and consider removing the plugin if no update is provided. The lack of a patch increases supply chain risk for sites relying on this plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the low privileges required and the potential for unauthorized access to countdown configurations. However, the lack of a public exploit and low EPSS score (0.0%) reduces immediate risk.

Deep Dive & Mechanics

The vulnerability resides in the countdowner-elementor plugin's AJAX handlers or REST endpoints that fail to properly enforce capability checks. Specifically, functions that handle saving, updating, or retrieving countdown settings do not verify that the current user has the required permissions (e.g., edit_posts or manage_options). This allows any authenticated user, including subscribers, to:

• Modify countdown timers
• Access sensitive plugin settings
• Potentially inject malicious data into the database

The flaw is categorized under CWE-862: Missing Authorization. The plugin likely uses wp_ajax_ hooks without a current_user_can() check, or uses incorrect capability levels.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's main PHP file (e.g., countdowner-elementor.php). A typical vulnerable pattern:

// Vulnerable: No capability check
add_action('wp_ajax_save_countdown', 'save_countdown_callback');
function save_countdown_callback() {
    // Process and save data without checking user permissions
    update_option('countdown_settings', $_POST['settings']);
}

A patched version would include:

// Patched: Check user capability
add_action('wp_ajax_save_countdown', 'save_countdown_callback');
function save_countdown_callback() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized');
    }
    // Process and save data
    update_option('countdown_settings', $_POST['settings']);
}

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Authenticated session with low-privilege user (e.g., subscriber).
2. Identify Endpoints: Use browser developer tools or intercept proxy to find AJAX actions (e.g., admin-ajax.php?action=countdowner_save).
3. Craft Request: Send a POST request with malicious payload to modify countdown settings.

# Example using curl
curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=countdowner_save&settings[expiry]=2025-12-31&settings[message]=Hacked" \
  --cookie "wordpress_logged_in_xxx=..."

4. Verify: Check if the countdown timer reflects the unauthorized changes.

Blue Team (Detection & Hardening)

• Monitor AJAX Requests: Look for admin-ajax.php requests from low-privilege users to plugin-specific actions.
• Audit User Roles: Ensure only administrators and editors have edit_posts capability.
• Disable Plugin: If no patch is available, deactivate and remove the plugin.
• Web Application Firewall (WAF): Block requests to admin-ajax.php with suspicious parameters from non-admin users.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if available)
  • countdowner-elementor.php: a1b2c3d4e5f6...
• Network Indicators:
  • POST requests to /wp-admin/admin-ajax.php with action=countdowner_* from low-privilege users.
• Log Entries:
  • WordPress debug log entries showing unauthorized AJAX calls.
• Database Changes:
  • Modified wp_options table entries for countdown_settings.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_66151_Countdowner {
    meta:
        description = "Detects vulnerable Countdowner for Elementor plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66151"
    strings:
        $vuln_func = "add_action('wp_ajax_" ascii wide nocase
        $no_cap = "current_user_can" ascii wide nocase
    condition:
        $vuln_func and not $no_cap
}

Sigma Rule

title: CVE-2025-66151 - Missing Authorization in Countdowner for Elementor
id: 8f9a2b3c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects unauthorized AJAX requests to Countdowner plugin endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=countdowner_'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-66151 - Countdowner for Elementor Missing Authorization";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=countdowner_"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Deactivate and delete the countdowner-elementor plugin until a patch is released.
2. Alternative: Replace with a different countdown plugin that has active security maintenance.
3. Hardening: Implement a Web Application Firewall (WAF) rule to block AJAX requests to plugin-specific actions from non-admin users.
4. Monitoring: Enable WordPress audit logging to track unauthorized access attempts.
5. User Role Review: Restrict edit_posts capability to trusted roles only.

Valters IT – Securing Digital Ecosystems