CVE-2025-6745

Executive Summary

CVE-2025-6745 is an information exposure vulnerability in the WoodMart WordPress plugin, affecting all versions up to and including 8.2.5. The flaw resides in the woodmart_get_posts_by_query() function, which lacks sufficient access controls on which posts can be included in query results. This allows unauthenticated attackers to extract data from password-protected, private, or draft posts that should be restricted. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. As a WordPress plugin vulnerability, it is specific to the WordPress ecosystem and does not involve server-level components like Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects the WoodMart plugin distributed via the WordPress plugin repository and commercial marketplaces. Since it is a WordPress plugin, supply chain risks include compromised plugin updates or malicious forks. Users should verify plugin integrity via checksums and only download from official sources.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthorized data access but does not enable code execution or data modification. The low EPSS score suggests limited active exploitation.

Deep Dive & Mechanics

The vulnerability exists in the woodmart_get_posts_by_query() function, which is used to retrieve posts based on user-supplied parameters. The function fails to enforce proper authorization checks, allowing unauthenticated users to query posts that are password-protected, private, or in draft status. The root cause is insufficient restriction on the post_status and post_password fields in the WordPress query arguments.

Attack Vector:

1. An attacker sends a crafted HTTP request to the WordPress site, targeting the AJAX endpoint that invokes woodmart_get_posts_by_query().
2. The request includes parameters such as post_status=draft or post_status=private to bypass normal visibility restrictions.
3. The function returns post data (titles, excerpts, metadata) that should be hidden from unauthenticated users.

Impact: Exposure of sensitive content, including draft posts, private pages, and password-protected articles. This could leak confidential business information, unpublished content, or user data.

Vulnerable vs. Patched Code

Vulnerable Code (<= 8.2.5):

function woodmart_get_posts_by_query($args) {
    $query = new WP_Query($args);
    return $query->posts;
}

The function directly passes user-supplied arguments to WP_Query without sanitizing post_status or checking user capabilities.

Patched Code (Hypothetical):

function woodmart_get_posts_by_query($args) {
    // Restrict to public posts only for unauthenticated users
    if (!is_user_logged_in()) {
        $args['post_status'] = 'publish';
    }
    $query = new WP_Query($args);
    return $query->posts;
}

The patched version enforces that unauthenticated users can only retrieve published posts, blocking access to draft, private, or password-protected content.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WoodMart plugin version <= 8.2.5
• At least one draft or private post exists

Exploitation Steps:

1. Identify the AJAX endpoint that calls woodmart_get_posts_by_query(). This is typically /wp-admin/admin-ajax.php with an action parameter.
2. Craft a request to retrieve draft posts:

curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
  -d "action=woodmart_get_posts&post_status=draft&posts_per_page=10"

3. Parse the JSON response to extract post titles, IDs, and excerpts.

Example Payload:

curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
  -d "action=woodmart_get_posts&post_status=private&post_type=post"

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with parameters like post_status=draft or post_status=private from unauthenticated users.
• Look for spikes in 403 errors or unusual query patterns.

Hardening:

• Apply the vendor patch immediately when available.
• As a workaround, add a custom filter to restrict post status for unauthenticated users:

add_filter('woodmart_get_posts_query_args', function($args) {
    if (!is_user_logged_in()) {
        $args['post_status'] = 'publish';
    }
    return $args;
});

• Use a Web Application Firewall (WAF) to block requests containing suspicious post_status values.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=woodmart_get_posts and post_status=draft or post_status=private
  • Unusual user agents or IPs making repeated AJAX calls

• File IOCs:

  • Modified functions.php or plugin files attempting to patch the vulnerability
  • Suspicious log entries in WordPress debug logs

• Log IOCs:

  • Apache/Nginx access logs showing POST /wp-admin/admin-ajax.php with post_status parameter
  • WordPress debug.log entries with woodmart_get_posts_by_query function calls

Detection Engineering

YARA Rule

rule CVE_2025_6745_WoodMart_InfoExposure {
    meta:
        description = "Detects vulnerable WoodMart plugin code with insufficient post access controls"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6745"
    strings:
        $func = "woodmart_get_posts_by_query"
        $wp_query = "WP_Query"
        $post_status = "post_status"
    condition:
        $func and $wp_query and $post_status
}

Sigma Rule

title: CVE-2025-6745 WoodMart Information Exposure
id: 8a3f7c2e-1b5d-4a9f-8c6e-3d2f1a0b9c8e
status: experimental
description: Detects exploitation attempts against CVE-2025-6745 via AJAX requests
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "admin-ajax.php"
            - "action=woodmart_get_posts"
            - "post_status=draft"
            - "post_status=private"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-6745 WoodMart Information Exposure Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"admin-ajax.php";
    http_uri;
    content:"action=woodmart_get_posts";
    http_client_body;
    content:"post_status";
    http_client_body;
    pcre:"/(draft|private)/Ri";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Check for an updated version of WoodMart (>= 8.2.6) and apply immediately.
2. Temporary Workaround: Add the custom filter code provided in the Blue Team section to restrict post access.
3. Audit Logs: Review web server and WordPress logs for signs of exploitation.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) with rules to block suspicious post_status parameters.
• Regularly update all WordPress plugins and themes.
• Conduct security audits of custom plugin code for similar authorization flaws.
• Enable WordPress debugging and monitor logs for unusual activity.

Patch Status: UNKNOWN. No official patch has been released as of this report. Users should monitor the WoodMart vendor for updates.

Valters IT