CVE-2025-68024

Executive Summary

CVE-2025-68024 is a Missing Authorization vulnerability in the Addonify – WooCommerce Wishlist plugin for WordPress, affecting versions up to and including 2.0.15. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification of wishlist data. The vulnerability is classified as a WordPress ecosystem issue, specifically within the plugin's permission checks. No public proof-of-concept (PoC) or patch details are currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor, Addonify. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the low complexity and no required privileges, but the impact is limited to low confidentiality and integrity loss.

Deep Dive & Mechanics

The vulnerability resides in the Addonify – WooCommerce Wishlist plugin, which extends WooCommerce to allow users to create and manage wishlists. The plugin fails to properly enforce authorization checks on certain AJAX actions or REST API endpoints, allowing unauthenticated users to access or modify wishlist data that should be restricted to authenticated users.

The core issue is a Missing Authorization (CWE-862) in the plugin's access control logic. Specifically, the plugin does not verify if the current user has the necessary capabilities (e.g., edit_posts or ownership of the wishlist) before processing requests. This can be exploited by sending crafted HTTP requests to the vulnerable endpoints.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's main PHP files handling AJAX requests. A typical vulnerable pattern might look like:

Vulnerable Code (addonify-wishlist.php):

add_action('wp_ajax_nopriv_addonify_wishlist_action', 'handle_wishlist_action');
function handle_wishlist_action() {
    // No capability check
    $wishlist_id = $_POST['wishlist_id'];
    // Process request without verifying user
}

Patched Code (Hypothetical):

add_action('wp_ajax_nopriv_addonify_wishlist_action', 'handle_wishlist_action');
function handle_wishlist_action() {
    if (!current_user_can('edit_posts') && !wp_verify_nonce($_POST['_wpnonce'], 'wishlist_nonce')) {
        wp_die('Unauthorized');
    }
    $wishlist_id = intval($_POST['wishlist_id']);
    // Process request with proper checks
}

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Install WordPress with WooCommerce and Addonify – WooCommerce Wishlist <= 2.0.15 on a local server.
2. Recon: Identify vulnerable endpoints by analyzing plugin source code or using a proxy to intercept AJAX calls.
3. Exploit: Send a crafted HTTP request to the vulnerable endpoint without authentication.

Example Exploit (cURL):

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d 'action=addonify_wishlist_action&wishlist_id=1&product_id=123'

Blue Team (Detection & Defense)

1. Monitor: Watch for unusual AJAX requests to admin-ajax.php with the addonify_wishlist_action action from unauthenticated users.
2. Harden: Implement Web Application Firewall (WAF) rules to block requests to vulnerable endpoints without proper nonce or authentication.
3. Audit: Regularly review plugin code for missing authorization checks and apply virtual patching if needed.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=addonify_wishlist_action and no _wpnonce parameter.
• Logs: WordPress debug logs showing unauthorized access attempts to wishlist-related actions.
• File: Modified or unexpected wishlist entries in the database.

Detection Engineering

YARA Rule

rule detect_addonify_wishlist_vuln {
    meta:
        description = "Detects exploitation attempts for CVE-2025-68024"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $ajax_action = "addonify_wishlist_action"
        $wp_ajax = "wp_ajax_nopriv_addonify_wishlist_action"
    condition:
        $ajax_action or $wp_ajax
}

Sigma Rule

title: Detect Addonify Wishlist Missing Authorization Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated requests to the vulnerable AJAX action
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=addonify_wishlist_action'
    condition: selection
falsepositives:
    - Legitimate authenticated requests (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68024 Addonify Wishlist Missing Authorization"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=addonify_wishlist_action"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Addonify – WooCommerce Wishlist plugin until a patch is available.
2. Short-term: Implement a virtual patch using a WAF to block unauthenticated requests to the vulnerable AJAX action.
3. Long-term: Apply the official patch from Addonify once released, or manually add authorization checks to the plugin code.
4. Monitor: Continuously monitor logs for exploitation attempts and review plugin updates.

Valters IT
Securing Digital Frontiers