CVE-2025-9544

Executive Summary

CVE-2025-9544 is a critical privilege escalation vulnerability in the Doppler Forms WordPress plugin (versions up to and including 2.5.1). The plugin registers an AJAX action install_extension without proper capability checks or nonce verification. This allows any authenticated user, including those with the Subscriber role, to install and activate additional extensions that are whitelisted by the main plugin. This vulnerability can lead to unauthorized plugin installation, potentially introducing malicious functionality or backdoors into the WordPress site.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. The lack of proper authorization checks in the AJAX handler represents a supply chain risk, as any authenticated user can escalate their privileges by installing additional components. Administrators should verify the integrity of the plugin and its extensions, and monitor for any unauthorized installations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs only a Subscriber-level account.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No direct data exposure.
• Integrity (I): High (H) - An attacker can install arbitrary extensions, potentially modifying site behavior.
• Availability (A): None (N) - No direct impact on availability.

CVSS Score: 6.5 (Medium) - However, the actual risk is higher due to the potential for complete site compromise via malicious extensions.

Deep Dive & Mechanics

The vulnerability resides in the install_extension AJAX action registered by the Doppler Forms plugin. The handler function does not perform any capability checks (e.g., current_user_can('install_plugins')) or nonce verification. This means any authenticated user can trigger the action.

The action likely accepts parameters such as the extension slug or URL. The plugin then downloads and activates the extension from a whitelist. An attacker with a Subscriber account can craft a request to install any whitelisted extension, potentially including those that introduce backdoors, data exfiltration, or other malicious capabilities.

The attack flow:

1. Attacker authenticates as a Subscriber.
2. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=install_extension and the target extension identifier.
3. The plugin installs and activates the extension without further checks.
4. The attacker now has access to the extension's functionality, which may include additional vulnerabilities or administrative capabilities.

Vulnerable vs. Patched Code

Vulnerable Code (doppler-forms.php or similar):

add_action('wp_ajax_install_extension', 'doppler_install_extension');
function doppler_install_extension() {
    // No capability check or nonce verification
    $extension_slug = $_POST['extension_slug'];
    // Install and activate the extension
    // ...
}

Patched Code (Hypothetical):

add_action('wp_ajax_install_extension', 'doppler_install_extension');
function doppler_install_extension() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'install_extension_nonce')) {
        wp_die('Security check failed.');
    }
    // Check user capabilities
    if (!current_user_can('install_plugins')) {
        wp_die('Insufficient permissions.');
    }
    $extension_slug = sanitize_text_field($_POST['extension_slug']);
    // Proceed with installation
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Doppler Forms plugin version <= 2.5.1 installed and activated.
• A valid user account with Subscriber role (or higher).

Exploitation Steps:

1. Log in as a Subscriber user.
2. Obtain a valid WordPress nonce for AJAX actions (if required by other actions, but this one lacks nonce).
3. Send a crafted POST request to the WordPress AJAX endpoint:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -d "action=install_extension&extension_slug=malicious-extension" \
  --cookie "wordpress_logged_in_<hash>=<session_cookie>"

4. The extension will be installed and activated. Verify by checking the plugins list or accessing the extension's functionality.

Note: The extension must be whitelisted by the Doppler Forms plugin. An attacker may need to first identify which extensions are whitelisted or attempt to bypass the whitelist.

Blue Team

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with action=install_extension from non-admin users.
2. Review user activity logs for unexpected plugin installations.
3. Check for newly installed plugins that are not part of the standard site configuration.
4. Verify user roles and permissions, ensuring Subscribers cannot install plugins.

Hunting Query (WordPress Database):

SELECT * FROM wp_options WHERE option_name = 'active_plugins';

Compare with a known baseline to detect unauthorized plugin activations.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=install_extension parameter.
• File System: Unexpected plugin files in /wp-content/plugins/ directory.
• Database: New entries in wp_options under active_plugins option.
• Logs: WordPress debug log entries showing AJAX handler calls from low-privilege users.

Detection Engineering

YARA Rule

rule Detect_Doppler_Forms_Vuln {
    meta:
        description = "Detects exploitation attempts of CVE-2025-9544 in Doppler Forms plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9544"
    strings:
        $ajax_action = "install_extension"
        $plugin_slug = "doppler-forms"
    condition:
        $ajax_action and $plugin_slug
}

Sigma Rule

title: CVE-2025-9544 - Doppler Forms Unauthorized Extension Installation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects AJAX requests to install_extension without proper authorization
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=install_extension'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9544 - Doppler Forms Unauthorized Extension Installation"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=install_extension"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Doppler Forms plugin until a patch is available.
2. Review all user accounts and remove any suspicious Subscriber accounts.
3. Audit installed plugins for any unauthorized extensions.

Long-term Fixes:

1. Apply vendor patch when released (currently UNKNOWN).
2. Implement Web Application Firewall (WAF) rules to block install_extension AJAX actions from non-admin users.
3. Restrict AJAX handler access using custom code or a security plugin.
4. Enable WordPress debugging to log all AJAX requests for monitoring.

Workaround (Code Level): Add the following to your theme's functions.php or a custom plugin:

add_action('wp_ajax_install_extension', function() {
    if (!current_user_can('install_plugins')) {
        wp_die('Unauthorized.');
    }
}, 1);

Valters IT
Securing Digital Frontiers