CVE-2025-67548

Executive Summary

CVE-2025-67548 is a Missing Authorization vulnerability in the WP Delicious WordPress plugin, specifically in the delicious-recipes component. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification. The vulnerability affects all versions of the plugin from n/a through 1.9.1. As of this report, no official patch has been released, and the vendor's status is marked as UNKNOWN/UNPATCHED.

This vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx. The CVSS score of 6.5 (Medium) and EPSS score of 0.0% indicate low exploitation probability currently, but the lack of a patch makes it a persistent risk for sites using the plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The delicious-recipes plugin is distributed via the WordPress Plugin Directory and third-party marketplaces. Since no patch is available, site administrators must consider removing or disabling the plugin until a fix is released. The supply chain risk is elevated due to the unknown patch status and potential for unpatched installations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the low complexity and no required privileges, but the impact is limited to low confidentiality and integrity loss. The EPSS score of 0.0% suggests very low exploitation activity in the wild.

Deep Dive & Mechanics

The vulnerability resides in the Missing Authorization (CWE-862) within the delicious-recipes plugin. The plugin fails to properly enforce access control checks on certain AJAX actions or REST API endpoints, allowing unauthenticated users to perform actions that should require administrative or editor-level privileges.

Root Cause: The plugin does not validate user capabilities before executing sensitive operations, such as modifying recipe data, accessing private recipes, or altering plugin settings. This is a classic case of Incorrectly Configured Access Control Security Levels.

Attack Vector: An attacker can send crafted HTTP requests to the vulnerable endpoints without authentication. For example, a POST request to an AJAX handler that modifies recipe metadata could be exploited.

Impact: Successful exploitation could lead to:

• Unauthorized access to private or draft recipes.
• Modification of recipe content (e.g., adding malicious links or code).
• Disclosure of sensitive information stored in recipe metadata.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable version (<= 1.9.1) likely contains code similar to:

// Vulnerable: No capability check
add_action('wp_ajax_nopriv_delicious_update_recipe', 'delicious_update_recipe_callback');
function delicious_update_recipe_callback() {
    // Process recipe update without checking user permissions
    $recipe_id = $_POST['recipe_id'];
    update_post_meta($recipe_id, 'recipe_data', $_POST['recipe_data']);
    wp_die();
}

A patched version would include a capability check:

// Patched: Added capability check
add_action('wp_ajax_nopriv_delicious_update_recipe', 'delicious_update_recipe_callback');
function delicious_update_recipe_callback() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $recipe_id = $_POST['recipe_id'];
    update_post_meta($recipe_id, 'recipe_data', $_POST['recipe_data']);
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with WP Delicious plugin version <= 1.9.1.
• Network access to the site.

Exploitation Steps:

1. Identify Vulnerable Endpoint: Use a web proxy or browser developer tools to find AJAX actions or REST endpoints exposed by the plugin. Common patterns include wp-json/delicious/v1/ or admin-ajax.php?action=delicious_*.

2. Craft Exploit Request: Send an unauthenticated POST request to the vulnerable endpoint. Example using curl:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -d "action=delicious_update_recipe&recipe_id=123&recipe_data=malicious_content"

3. Verify Exploitation: Check if the recipe data was modified without authentication. If successful, the attacker can read or modify any recipe.

Note: No public exploit code is available from Exploit-DB or other sources.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action parameters containing delicious_ from unauthenticated users.
• Look for HTTP 200 responses to POST requests that should require authentication.

Hardening:

• Disable or remove the delicious-recipes plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to known vulnerable endpoints.
• Use a WordPress security plugin to add additional access control checks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=delicious_* from unauthenticated IPs.
  • Unusual recipe modification timestamps without corresponding admin login events.
• File IOCs:
  • Modified recipe post meta data in the database.
  • Presence of unexpected content in recipe fields.
• Log IOCs:
  • WordPress debug log entries showing failed capability checks (if patched).
  • Web server access logs with 200 responses to AJAX endpoints from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2025_67548_WP_Delicious_Missing_Auth {
    meta:
        description = "Detects exploitation attempts for CVE-2025-67548 in WP Delicious plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67548"
    strings:
        $ajax_action = "action=delicious_" nocase
        $recipe_param = "recipe_id=" nocase
        $admin_ajax = "admin-ajax.php" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-67548 WP Delicious Missing Authorization Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to WP Delicious AJAX endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=delicious_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin actions (if authentication is bypassed)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67548 WP Delicious Missing Authorization Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=delicious_"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: Remove or deactivate the delicious-recipes plugin until a patch is released.
2. Monitor Logs: Review web server and WordPress logs for signs of exploitation.
3. Update WordPress Core: Ensure WordPress is updated to the latest version to benefit from general security improvements.

Long-term Mitigation:

• Vendor Contact: Reach out to WP Delicious for a patch timeline.
• Alternative Plugin: Consider switching to a different recipe management plugin with active security support.
• WAF Rules: Implement custom WAF rules to block unauthenticated requests to admin-ajax.php with delicious_ actions.

Patch Status: UNKNOWN / UNPATCHED. No official patch is available as of this report.

Valters IT
Securing Digital Frontiers