CVE-2025-68588

Executive Summary

CVE-2025-68588 is a Missing Authorization vulnerability in the TS Poll WordPress plugin (vendor: Totalsoft). The flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or manipulation of poll data. The vulnerability affects all versions of TS Poll up to and including 2.5.5. No public proof-of-concept (PoC) or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, given the plugin's presence in the WordPress ecosystem, the risk of automated scanning and exploitation remains.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed TS Poll from the WordPress dashboard or via direct download are affected. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors leveraging this flaw in broader campaigns.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. The vulnerability allows unauthorized access to poll data but does not enable data modification or denial of service. Exploitation is straightforward but limited in impact.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the TS Poll plugin's REST API endpoints or AJAX handlers. Specifically, the plugin fails to verify user capabilities (e.g., manage_options or edit_posts) before allowing access to poll configuration, results, or administrative functions. An unauthenticated attacker can send crafted HTTP requests to endpoints such as:

• /wp-admin/admin-ajax.php?action=ts_poll_get_results
• /wp-json/ts-poll/v1/polls

These endpoints may return sensitive poll data (e.g., vote counts, voter IPs, or poll settings) without requiring authentication. The flaw is classified under CWE-862: Missing Authorization.

Root Cause: The plugin's code likely uses wp_ajax_nopriv_* hooks without proper capability checks, or it exposes REST routes without permission_callback validation.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is inferred:

Vulnerable (<= 2.5.5):

add_action('wp_ajax_nopriv_ts_poll_get_results', 'ts_poll_get_results');
function ts_poll_get_results() {
    $poll_id = $_GET['poll_id'];
    $results = get_poll_results($poll_id);
    wp_send_json($results);
}

Patched (hypothetical):

add_action('wp_ajax_ts_poll_get_results', 'ts_poll_get_results');
add_action('wp_ajax_nopriv_ts_poll_get_results', 'ts_poll_get_results_public');
function ts_poll_get_results() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $poll_id = $_GET['poll_id'];
    $results = get_poll_results($poll_id);
    wp_send_json($results);
}
function ts_poll_get_results_public() {
    // Only return public data
    $poll_id = $_GET['poll_id'];
    $results = get_public_poll_results($poll_id);
    wp_send_json($results);
}

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify WordPress sites using TS Poll via Shodan dorks or Google dorking (inurl:/wp-content/plugins/ts-poll).
2. Exploit: Send a crafted GET request to the vulnerable endpoint:

   curl -X GET "http://target.com/wp-admin/admin-ajax.php?action=ts_poll_get_results&poll_id=1"
   

   If successful, the response will contain poll results or admin data.
3. Post-Exploitation: Use the leaked data for further attacks (e.g., social engineering, credential stuffing).

Blue Team

1. Detection: Monitor for unusual requests to admin-ajax.php with action=ts_poll_* parameters from unauthenticated sources.
2. Honeypot: Deploy a fake TS Poll endpoint that logs attacker IPs and payloads.
3. Mitigation: Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=ts_poll_* unless the user is authenticated.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-admin/admin-ajax.php with action=ts_poll_get_results or similar.
  • Unusual spikes in traffic to /wp-json/ts-poll/v1/ endpoints.
• File:
  • Modified wp-content/plugins/ts-poll/ files (if attacker uploads backdoor).
• Log:
  • WordPress debug logs showing wp_ajax_nopriv_ts_poll_* calls without authentication.

Detection Engineering

YARA Rule

rule CVE_2025_68588_TS_Poll_Missing_Auth {
    meta:
        description = "Detects TS Poll plugin files with missing authorization"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68588"
    strings:
        $vuln_func = "wp_ajax_nopriv_ts_poll" nocase
        $no_cap = "current_user_can" nocase
    condition:
        $vuln_func and not $no_cap
}

Sigma Rule

title: CVE-2025-68588 - TS Poll Missing Authorization
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated access to TS Poll admin-ajax endpoints
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=ts_poll_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin users (if authenticated)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68588 - TS Poll Missing Authorization Attempt"; flow:to_server; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=ts_poll_"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the TS Poll plugin until a patch is released.
2. Temporary: Add a WAF rule to block unauthenticated requests to admin-ajax.php with action=ts_poll_*.
3. Long-term: Monitor the vendor's website for a patched version (>= 2.5.6). Apply the update as soon as it becomes available.
4. Workaround: If the plugin is critical, restrict access to the vulnerable endpoints via .htaccess:

   <FilesMatch "admin-ajax\.php">
       Require ip 192.168.1.0/24
   </FilesMatch>
   

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst