CVE-2025-68023

Executive Summary

CVE-2025-68023 is a Missing Authorization vulnerability in the Addonify – Compare Products For WooCommerce WordPress plugin, affecting versions up to and including 1.1.17. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data exposure or manipulation of product comparison features. The vulnerability is classified as a WordPress ecosystem issue, specifically within the plugin's AJAX handlers or REST endpoints that fail to enforce proper capability checks. With a CVSS score of 6.5 (Medium), the risk is elevated due to the low attack complexity and network-based vector, though no public proof-of-concept (PoC) or exploit code has been released as of this analysis.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress Plugin Directory. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a critical component of the WordPress supply chain. Users should verify the integrity of their plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains within its security authority.
• Confidentiality Impact (C): Low (L) – Limited data exposure.
• Integrity Impact (I): Low (L) – Limited data modification.
• Availability Impact (A): None (N) – No denial of service.

Threat Level: Medium. The lack of authentication requirements and low complexity make this an attractive target for automated scanning and exploitation, especially in WordPress environments with the plugin active.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the plugin's AJAX actions or REST API endpoints. The plugin likely registers handlers for product comparison operations (e.g., adding/removing products from a comparison list, retrieving comparison data) without verifying that the requesting user has the appropriate capabilities (e.g., edit_posts, manage_options). This allows any unauthenticated visitor to invoke these functions.

Root Cause: The plugin uses wp_ajax_* and wp_ajax_nopriv_* hooks but fails to implement current_user_can() or check_ajax_referer() with proper nonce validation. Alternatively, REST API routes registered via register_rest_route() may lack permission_callback parameters.

Attack Vector: An attacker sends crafted HTTP requests to the vulnerable endpoints, bypassing access controls to:

• View or modify comparison lists of other users.
• Expose sensitive product data (e.g., hidden products, pricing).
• Potentially trigger stored XSS if comparison data is not sanitized.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common fixes for such vulnerabilities.

Vulnerable Code (Example):

add_action('wp_ajax_addonify_compare_add', 'addonify_compare_add_callback');
add_action('wp_ajax_nopriv_addonify_compare_add', 'addonify_compare_add_callback');

function addonify_compare_add_callback() {
    // No capability check
    $product_id = intval($_POST['product_id']);
    // Process comparison...
    wp_die();
}

Patched Code (Expected Fix):

add_action('wp_ajax_addonify_compare_add', 'addonify_compare_add_callback');
// Remove nopriv hook to require authentication
// add_action('wp_ajax_nopriv_addonify_compare_add', 'addonify_compare_add_callback');

function addonify_compare_add_callback() {
    // Verify nonce and capability
    if (!wp_verify_nonce($_POST['_wpnonce'], 'addonify_compare_nonce') || !current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $product_id = intval($_POST['product_id']);
    // Process comparison...
    wp_die();
}

Exploitation & Lab Setup

Red Team (Offensive)

1. Setup: Deploy a WordPress instance with WooCommerce and Addonify Compare Products v1.1.17.
2. Reconnaissance: Identify AJAX endpoints by scanning for admin-ajax.php actions or REST routes.

   curl -s "http://target/wp-admin/admin-ajax.php?action=addonify_compare_get_list"
   

3. Exploitation: Send unauthenticated requests to manipulate comparison data.

   curl -X POST "http://target/wp-admin/admin-ajax.php" \
     -d "action=addonify_compare_add&product_id=123"
   

4. Data Exfiltration: Retrieve comparison lists of other users.

   curl "http://target/wp-json/addonify-compare/v1/list?user_id=1"
   

Blue Team (Defensive)

1. Detection: Monitor for unusual AJAX requests to admin-ajax.php with action parameters containing addonify_compare.
2. Honeypot: Create a fake endpoint that logs attacker IPs and payloads.
3. Mitigation: Temporarily disable the plugin or apply a WAF rule to block unauthenticated requests to its endpoints.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action=addonify_compare_* from unauthenticated sources.
  • GET requests to /wp-json/addonify-compare/v1/* without valid authentication tokens.
• File System:
  • Modified plugin files in /wp-content/plugins/addonify-compare-products/ (e.g., includes/class-compare-ajax.php).
• Logs:
  • WordPress debug log entries showing wp_die calls with status 403 from the plugin.
  • Web server access logs with repeated admin-ajax.php requests from the same IP.

Detection Engineering

YARA Rule

rule CVE_2025_68023_Addonify_Compare {
    meta:
        description = "Detects vulnerable Addonify Compare Products plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68023"
    strings:
        $ajax_hook = /add_action\(['\"]wp_ajax_nopriv_addonify_compare_/
        $no_cap = /function addonify_compare_\w+_callback/
        $no_nonce = /wp_verify_nonce/
    condition:
        $ajax_hook and $no_cap and not $no_nonce
}

Sigma Rule

title: CVE-2025-68023 - Addonify Compare Products Missing Authorization
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated AJAX requests to Addonify Compare Products endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=addonify_compare_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate authenticated users (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68023 - Addonify Compare Products Unauthenticated AJAX"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=addonify_compare_"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Addonify – Compare Products For WooCommerce plugin until a patch is released.
2. Vendor Patch: Monitor the WordPress Plugin Directory for an update (version > 1.1.17). Apply immediately when available.
3. Virtual Patching: Use a Web Application Firewall (WAF) to block unauthenticated requests to admin-ajax.php with action parameters starting with addonify_compare_.
4. Code Hardening: If you have developer access, add current_user_can('edit_posts') checks to all AJAX callbacks and REST endpoints.
5. Monitoring: Enable WordPress debug logging and review access logs for suspicious patterns.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert