CVE-2025-66152

Executive Summary

CVE-2025-66152 is a Missing Authorization vulnerability in the Merkulove Criptopayer for Elementor WordPress plugin (slug: criptopayer-elementor). This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification. The vulnerability affects all versions up to and including 1.0.1. As of this report, no official patch has been released, and the vendor's patch status is UNKNOWN / UNPATCHED.

This vulnerability is classified as a WordPress ecosystem issue, specifically within the plugin's permission checks. It is not related to the underlying web server (Apache/Nginx). The CVSS score of 5.4 (Medium) reflects the potential for low-impact confidentiality and integrity breaches without requiring authentication.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin directly from the repository or via automatic updates are affected. Since the plugin is not an NPM, PyPI, Go, or Ruby package, standard supply chain security measures for those ecosystems do not apply. However, the risk of supply chain compromise exists if the plugin's update mechanism is abused or if the vendor's infrastructure is compromised.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited data modification possible.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. The vulnerability is easily exploitable remotely without authentication, but the impact is limited to low confidentiality and integrity breaches.

Deep Dive & Mechanics

The vulnerability stems from a Missing Authorization check (CWE-862) in the criptopayer-elementor plugin. The plugin likely registers AJAX actions or REST API endpoints that are intended for authenticated users (e.g., administrators or shop managers) but fails to verify the user's capabilities before processing requests.

Mechanism:

1. The plugin registers a WordPress AJAX action (e.g., wp_ajax_* or wp_ajax_nopriv_*) or a REST API route.
2. The callback function performs sensitive operations (e.g., reading or modifying payment settings, transaction logs, or user data).
3. The code does not include a capability check (e.g., current_user_can('manage_options')) or a nonce verification.
4. An unauthenticated attacker can send a crafted HTTP request to the vulnerable endpoint, bypassing access controls.

Example vulnerable code pattern:

add_action('wp_ajax_nopriv_criptopayer_update_settings', 'criptopayer_update_settings');
function criptopayer_update_settings() {
    // No capability check!
    update_option('criptopayer_settings', $_POST['settings']);
}

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on the vulnerability type.

Vulnerable Code (version <= 1.0.1):

add_action('wp_ajax_nopriv_criptopayer_get_transactions', 'criptopayer_get_transactions');
function criptopayer_get_transactions() {
    // Missing authorization check
    $transactions = get_option('criptopayer_transactions');
    wp_send_json_success($transactions);
}

Patched Code (hypothetical):

add_action('wp_ajax_criptopayer_get_transactions', 'criptopayer_get_transactions');
function criptopayer_get_transactions() {
    // Added capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $transactions = get_option('criptopayer_transactions');
    wp_send_json_success($transactions);
}

The patch would involve:

• Changing wp_ajax_nopriv_* to wp_ajax_* (requires authentication).
• Adding current_user_can() checks.
• Implementing nonce verification.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Criptopayer for Elementor <= 1.0.1 installed and activated.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable AJAX action or REST endpoint. Common patterns include:
   • /wp-admin/admin-ajax.php?action=criptopayer_*
   • /wp-json/criptopayer/v1/*
2. Send a crafted request without authentication.

Example cURL command:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  -d 'action=criptopayer_get_transactions' \
  -H 'Content-Type: application/x-www-form-urlencoded'

Expected Output:

{"success":true,"data":{"transactions":[...]}}

Blue Team (Detection & Hardening)

Detection:

• Monitor for requests to /wp-admin/admin-ajax.php with action parameters starting with criptopayer_ from unauthenticated users.
• Look for unusual access to /wp-json/criptopayer/v1/* endpoints.

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to plugin-specific endpoints.
• Use a security plugin (e.g., Wordfence) to add virtual patching.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action=criptopayer_* without a valid _wpnonce parameter.
  • HTTP requests to /wp-json/criptopayer/v1/* without a valid X-WP-Nonce header.
• File IOCs:
  • Modified plugin files in /wp-content/plugins/criptopayer-elementor/.
  • Unexpected entries in the wp_options table related to criptopayer_*.
• Log IOCs:
  • Repeated 403 errors followed by 200 responses on AJAX endpoints.
  • Access logs showing requests to admin-ajax.php with action=criptopayer_* from IPs not in the admin range.

Detection Engineering

YARA Rule

rule CVE_2025_66152_Criptopayer_Missing_Auth {
    meta:
        description = "Detects missing authorization in Criptopayer for Elementor plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-66152"
    strings:
        $vuln_func = /wp_ajax_nopriv_criptopayer_/
        $no_cap_check = /current_user_can/
    condition:
        $vuln_func and not $no_cap_check
}

Sigma Rule

title: CVE-2025-66152 - Missing Authorization in Criptopayer for Elementor
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to Criptopayer AJAX endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=criptopayer_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin requests (if nonce is present)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66152 - Criptopayer Missing Authorization Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=criptopayer_"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement virtual patching using a WAF to block unauthenticated requests to criptopayer_* AJAX actions.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor must release a patched version (e.g., 1.0.2) that adds proper capability checks and nonce verification.
• Users should update to the latest version once available.

Workaround:

• Add the following code to the theme's functions.php to block unauthenticated access:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX) {
        if (isset($_POST['action']) && strpos($_POST['action'], 'criptopayer_') === 0) {
            if (!current_user_can('manage_options')) {
                wp_die('Unauthorized', 403);
            }
        }
    }
});

Valters IT
DevSecOps & Cyber Threat Intelligence Division