CVE-2025-66160

Executive Summary

CVE-2025-66160 is a Missing Authorization vulnerability in the Merkulove Select Graphist for Elementor WordPress plugin (versions <= 1.2.10). This flaw allows unauthenticated attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification. The vulnerability resides in the WordPress plugin ecosystem, specifically within the graphist-elementor component. With a CVSS score of 5.4 (Medium), it poses a moderate risk to sites running the affected plugin. No public proof-of-concept (PoC) or exploit code has been released, and no patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and potentially third-party marketplaces. Since the plugin is a component of the WordPress ecosystem, any site using the vulnerable version (<= 1.2.10) is at risk. The lack of a patch means that supply chain security is compromised until the vendor releases an update. Users should monitor the plugin’s changelog and consider disabling the plugin if it is not critical.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited data modification possible.
• Availability (A): None – No impact on system availability.

Threat Level: Medium. The vulnerability is easy to exploit but has limited impact. However, the absence of a patch increases the risk for unmitigated installations.

Deep Dive & Mechanics

The vulnerability is a Missing Authorization issue (CWE-862) in the graphist-elementor plugin. The plugin likely fails to properly enforce access controls on certain AJAX actions or REST API endpoints, allowing unauthenticated users to perform actions that should require administrative privileges. This could include reading or modifying plugin settings, accessing sensitive data, or performing other unauthorized operations.

The flaw is triggered by sending crafted HTTP requests to the vulnerable endpoints. Since the plugin is part of the WordPress ecosystem, the attack surface is limited to WordPress installations with the plugin active. The exact endpoint is not publicly documented, but typical patterns involve wp-admin/admin-ajax.php or custom REST routes.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison cannot be made. However, the vulnerable code likely lacks a capability check (e.g., current_user_can()) before processing requests. A patched version would include proper authorization checks, such as:

// Vulnerable code (example)
add_action('wp_ajax_nopriv_graphist_action', 'handle_graphist_action');
function handle_graphist_action() {
    // No capability check
    update_option('graphist_setting', $_POST['value']);
}

// Patched code (example)
add_action('wp_ajax_graphist_action', 'handle_graphist_action');
function handle_graphist_action() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    update_option('graphist_setting', $_POST['value']);
}

The vulnerable version allows unauthenticated access, while the patched version restricts actions to users with the manage_options capability.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress (latest version) on a local server (e.g., using Docker or XAMPP).
2. Install the vulnerable plugin graphist-elementor version <= 1.2.10.
3. Ensure the plugin is activated.

Exploitation Steps:

1. Identify the vulnerable endpoint by analyzing the plugin’s JavaScript or PHP files. Look for wp_ajax_nopriv_* hooks or REST routes without permission checks.
2. Send a crafted HTTP request to the endpoint. Example using curl:

   curl -X POST http://target/wp-admin/admin-ajax.php \
        -d 'action=graphist_action&value=malicious_data'
   

3. Verify unauthorized access by checking if the action was performed (e.g., option updated in database).

Note: No public exploit code is available, so this is a generic approach.

Blue Team (Defensive)

Detection:

• Monitor for unusual POST requests to admin-ajax.php with action parameters related to graphist.
• Look for requests from unauthenticated users to endpoints that should require authentication.
• Use the detection rules provided below.

Mitigation:

• Disable the plugin immediately if not critical.
• Implement a Web Application Firewall (WAF) rule to block requests to known vulnerable endpoints.
• Apply virtual patching by adding a custom function to your theme’s functions.php:

  add_action('init', function() {
      if (defined('DOING_AJAX') && DOING_AJAX) {
          $action = $_REQUEST['action'] ?? '';
          if (strpos($action, 'graphist') !== false && !is_user_logged_in()) {
              wp_die('Unauthorized');
          }
      }
  });
  

Indicators of Compromise (IOCs)

• File Indicators:

  • Presence of the plugin directory: /wp-content/plugins/graphist-elementor/
  • Modified options in the wp_options table with names containing graphist.

• Network Indicators:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=graphist_* parameters.
  • Requests from IP addresses not associated with authenticated users.

• Log Indicators:

  • WordPress debug log entries showing unauthorized access attempts to plugin endpoints.
  • Web server access logs with 200 responses to admin-ajax.php with graphist action.

Detection Engineering

YARA Rule

rule CVE_2025_66160_Graphist_Elementor {
    meta:
        description = "Detects vulnerable Graphist for Elementor plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66160"
    strings:
        $vuln_func = "wp_ajax_nopriv_graphist" nocase
        $vuln_hook = "add_action('wp_ajax_nopriv_" nocase
    condition:
        $vuln_func or $vuln_hook
}

Sigma Rule

title: CVE-2025-66160 - Missing Authorization in Graphist for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated access attempts to Graphist for Elementor plugin endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=graphist'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin actions (if logged in)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66160 - Graphist for Elementor Unauthenticated Access"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=graphist"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not essential for business operations.
2. Apply virtual patching using a WAF or custom code (see Blue Team section).
3. Monitor logs for any signs of exploitation.

Long-Term Fix:

• Await an official patch from Merkulove. Check the plugin’s update page regularly.
• If the plugin is abandoned, consider migrating to an alternative Elementor addon that provides similar functionality with proper security.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.