CVE-2025-68000

Executive Summary

CVE-2025-68000 is a Missing Authorization vulnerability in the PickPlugins Testimonial Slider WordPress plugin, affecting versions up to and including 2.0.15. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification of testimonial entries. The vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx. The CVSS score is 6.5 (Medium), and no public exploit code or patch is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains due to the lack of a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and consider disabling the plugin until a patch is released. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but has limited impact. However, the lack of a patch increases the risk for unmaintained sites.

Deep Dive & Mechanics

The vulnerability resides in the Testimonial Slider plugin’s access control mechanisms. The plugin fails to properly validate user permissions when processing certain AJAX actions or REST API endpoints. Specifically, the testimonial_slider_ajax_handler function does not enforce capability checks before allowing operations such as creating, editing, or deleting testimonial entries. This allows any unauthenticated user to send crafted HTTP requests to manipulate testimonial data.

The root cause is the use of wp_ajax_nopriv_* hooks without corresponding current_user_can() checks, or the omission of nonce verification in some endpoints. Attackers can enumerate endpoints by analyzing the plugin’s JavaScript files (e.g., testimonial-slider/public/js/testimonial-slider-public.js).

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.0.15):

add_action('wp_ajax_nopriv_testimonial_slider_save', 'testimonial_slider_save_callback');
function testimonial_slider_save_callback() {
    // No capability check
    $data = $_POST['testimonial_data'];
    // Process and save data
    update_post_meta($post_id, 'testimonial_data', $data);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_nopriv_testimonial_slider_save', 'testimonial_slider_save_callback');
function testimonial_slider_save_callback() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'testimonial_slider_nonce')) {
        wp_die('Security check failed');
    }
    // Check user capability
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized');
    }
    $data = sanitize_text_field($_POST['testimonial_data']);
    // Process and save data
    update_post_meta($post_id, 'testimonial_data', $data);
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

1. Reconnaissance: Identify WordPress sites using the plugin via Shodan dorks or WPScan.
2. Endpoint Discovery: Analyze the plugin’s JavaScript to find AJAX actions (e.g., testimonial_slider_save, testimonial_slider_delete).
3. Craft Exploit: Send a POST request to wp-admin/admin-ajax.php with the action parameter and malicious data.

Proof-of-Concept (PoC) using cURL:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=testimonial_slider_save&testimonial_data[title]=Hacked&testimonial_data[content]=Injected"

Blue Team (Detection & Hardening)

• Monitor AJAX Requests: Look for unexpected admin-ajax.php requests from unauthenticated users.
• Web Application Firewall (WAF): Block requests to admin-ajax.php with suspicious action parameters.
• Disable Plugin: Temporarily deactivate the plugin until a patch is available.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=testimonial_slider_* parameters from unauthenticated IPs.
• File: Unexpected testimonial entries in the WordPress database (wp_postmeta table with testimonial_data meta key).
• Log: WordPress debug log entries showing wp_ajax_nopriv_testimonial_slider_* calls.

Detection Engineering

YARA Rule

rule CVE_2025_68000_Testimonial_Slider {
    meta:
        description = "Detects exploitation attempts for CVE-2025-68000 in PickPlugins Testimonial Slider"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68000"
    strings:
        $ajax_action = "testimonial_slider_save" nocase
        $ajax_action2 = "testimonial_slider_delete" nocase
        $wp_ajax = "wp-admin/admin-ajax.php" nocase
    condition:
        any of ($ajax_action*) and $wp_ajax
}

Sigma Rule

title: CVE-2025-68000 Testimonial Slider Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized AJAX requests to Testimonial Slider plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=testimonial_slider_save'
            - 'action=testimonial_slider_delete'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68000 Testimonial Slider Exploitation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=testimonial_slider_save"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Testimonial Slider plugin until a patch is released.
2. Workaround: Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to admin-ajax.php with testimonial_slider_* actions.
3. Long-term: Monitor the plugin’s official page for updates. Consider replacing the plugin with an alternative that has active security maintenance.
4. Hardening: Ensure WordPress core, themes, and other plugins are up-to-date. Use a security plugin like Wordfence to add an extra layer of protection.

Valters IT – Securing digital ecosystems through proactive threat intelligence.