CVE-2025-69184

Executive Summary

CVE-2025-69184 is a Missing Authorization vulnerability (CWE-862) in the Institutions Directory WordPress plugin by e-plugins. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to sensitive directory data. The vulnerability affects all versions up to and including 1.3.4. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant due to the lack of authentication requirements.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. WordPress plugins are distributed via the official WordPress Plugin Directory and third-party marketplaces. The absence of a patch means that all sites running the affected plugin version are at risk. Administrators should monitor the plugin’s update channel and consider temporary deactivation if the plugin is not critical.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.3 (HIGH)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: HIGH. The vulnerability is trivial to exploit remotely without authentication, leading to full disclosure of sensitive directory data.

Deep Dive & Mechanics

The Institutions Directory plugin provides functionality to list and manage institutional data (e.g., universities, colleges, research centers). The vulnerability stems from missing authorization checks on AJAX endpoints or REST API routes that serve directory content. Specifically, the plugin fails to verify user capabilities or nonces before returning data, allowing any unauthenticated visitor to query the directory.

Root Cause: The plugin uses wp_ajax_nopriv_* hooks or improperly configured register_rest_route() calls without permission_callback validation. This means that even unauthenticated users can trigger actions intended for administrators or authenticated users.

Attack Vector:

1. An attacker sends a crafted HTTP request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=get_institutions).
2. The server processes the request without checking if the user has the read or manage_options capability.
3. The attacker receives the full directory data, including potentially sensitive fields like email addresses, phone numbers, or internal notes.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical fix based on best practices.

Vulnerable Code (institutions-directory/includes/class-ajax.php):

add_action('wp_ajax_nopriv_get_institutions', 'id_get_institutions');
function id_get_institutions() {
    global $wpdb;
    $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}institutions");
    wp_send_json($results);
}

Patched Code (Hypothetical):

add_action('wp_ajax_get_institutions', 'id_get_institutions');
add_action('wp_ajax_nopriv_get_institutions', 'id_get_institutions_public');
function id_get_institutions_public() {
    // Only return non-sensitive data for unauthenticated users
    global $wpdb;
    $results = $wpdb->get_results("SELECT id, name, website FROM {$wpdb->prefix}institutions WHERE public = 1");
    wp_send_json($results);
}
function id_get_institutions() {
    // Full data for authenticated users
    if (!current_user_can('read')) {
        wp_die('Unauthorized', 403);
    }
    global $wpdb;
    $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}institutions");
    wp_send_json($results);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Institutions Directory plugin <= 1.3.4
• Network access to the target

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns include:
   • /wp-admin/admin-ajax.php?action=get_institutions
   • /wp-json/institutions/v1/list
2. Send a direct request using curl:

   curl -X GET "http://target.com/wp-admin/admin-ajax.php?action=get_institutions"
   

3. If successful, the response will contain JSON data of all institutions.

Example Response:

[
  {
    "id": 1,
    "name": "University of Example",
    "email": "admin@example.edu",
    "phone": "+1-555-0199",
    "internal_notes": "VIP contact - do not share"
  }
]

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual requests to admin-ajax.php with unknown actions.
• Look for spikes in unauthenticated API calls to plugin-specific endpoints.

Hardening:

• Temporarily disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with actions starting with get_institutions from unauthenticated users.
• Use a security plugin (e.g., Wordfence) to add virtual patching.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /wp-admin/admin-ajax.php with action=get_institutions or similar.
• Requests to /wp-json/institutions/v1/ without authentication cookies.

File IOCs:

• Presence of the plugin directory /wp-content/plugins/institutions-directory/ with version file showing <= 1.3.4.

Log IOCs:

• Apache/Nginx access logs showing GET /wp-admin/admin-ajax.php?action=get_institutions with HTTP/1.1" 200 and no Cookie header.

Detection Engineering

YARA Rule

rule CVE_2025_69184_Institutions_Directory {
    meta:
        description = "Detects exploitation attempts for CVE-2025-69184 in Institutions Directory plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-69184"
    strings:
        $ajax_action = "action=get_institutions"
        $rest_route = "/institutions/v1/"
        $plugin_path = "wp-content/plugins/institutions-directory"
    condition:
        any of ($ajax_action, $rest_route) or $plugin_path
}

Sigma Rule

title: CVE-2025-69184 - Institutions Directory Unauthenticated Data Access
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated requests to Institutions Directory plugin endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'action=get_institutions'
            - '/institutions/v1/'
        cs-uri-stem|contains: '/wp-admin/admin-ajax.php'
    condition: selection
falsepositives:
    - Legitimate plugin functionality if misconfigured
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-69184 - Institutions Directory Unauthenticated Access Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=get_institutions"; http_uri;
    sid:10000001;
    rev:1;
    reference:cve,2025-69184;
    classtype:attempted-recon;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential: Navigate to WordPress Admin > Plugins > Deactivate "Institutions Directory".
2. Apply virtual patching via WAF rules to block unauthenticated access to plugin endpoints.
3. Monitor logs for any signs of exploitation.

Long-term Fix:

• Await an official patch from e-plugins. Contact the vendor for an ETA.
• If the plugin is abandoned, consider migrating to an alternative directory plugin with proper access controls.

Workaround:

• Add the following code to your theme's functions.php to block unauthenticated AJAX requests:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX && !is_user_logged_in()) {
        $blocked_actions = array('get_institutions');
        $action = isset($_REQUEST['action']) ? $_REQUEST['action'] : '';
        if (in_array($action, $blocked_actions)) {
            wp_die('Access denied', 403);
        }
    }
});

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Report generated for CVE-2025-69184