ANALYSIS · e544437d· FINISHED 2025-12-21 · PATCHDIFF

Folder Analysiscache/frontend-post-submission-manager-lite_1.2.5 → cache/frontend-post-submission-manager-lite_1.2.6✓ COMPLETED

Files3

Vulnerable1

True positives1

CVE matched1

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2025-14080

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 3 CVE 1 Vuln 1

SORT

1 files · page 1/1

includes/cores/ajax-process-form.php

AI: 1 vulnerabilities

CWE-639: Authorization Bypass Through User-Controlled Key CVE-2025-14080 1 TP

#%!d(float64=003)

1–1 of 1

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2025-14080

Security writeup for CVE-2025-14080

✓ 1 FILE

## The Exploit
Unauthenticated attackers can submit `post_id` via the guest posting AJAX action and overwrite any post.

```bash
curl -X POST 'https://TARGET/wp-admin/admin-ajax.php' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'action=fpsml_form_process&post_id=123&post_title=owned+title&post_content=owned+content&post_excerpt=owned+excerpt'
```

The request lands on the plugin’s `fpsml_form_process` handler and returns a normal success response instead of rejecting it. The targeted post with ID `123` is updated, changing title/content/excerpt and allowing the attacker to effectively hijack arbitrary content via the guest form.

## What the Patch Did
Before:

```php
$post_id = (!empty( $form_data['post_id'] )) ? intval( $form_data['post_id'] ) : 0;
$post_title = (!empty( $form_data['post_title'] )) ? $form_data['post_title'] : '';
$post_content = (!empty( $form_data['post_content'] )) ? $form_data['post_content'] : '';
```

After:

```php
if (is_user_logged_in()) {
    $post_id = (!empty($form_data['post_id'])) ? intval($form_data['post_id']) : 0;
    if (!empty($post_id)) {
        if (!current_user_can('edit_post', $post_id)) {
            $response['status'] = 403;
            $response['message'] = esc_html__('Unauthorized', 'frontend-post-submission-manager-lite');
            die(json_encode($response));
        }
    }
} else {
    if (!empty($form_data['post_id'])) {
        $response['status'] = 403;
        $response['message'] = esc_html__('Unauthorized', 'frontend-post-submission-manager-lite');
        die(json_encode($response));
    }
}
```

The patch added a WordPress capability check with `current_user_can('edit_post', $post_id)` and an unauthenticated denial path using `is_user_logged_in()`. That prevents guest requests from supplying `post_id` and prevents logged-in users from editing posts they do not have permission to edit.

## Root Cause
This is a Broken Access Control / Insecure Direct Object Reference vulnerability (CWE-639). The attacker-controlled POST parameter `post_id` enters the `fpsml_form_process` AJAX handler and is converted to an integer. That value is then used to update an existing post without checking whether the requester is authenticated or authorized to edit that specific post. The trust boundary between the public guest posting form and the post-editing logic was crossed unchecked.

## Why It Works
The load-bearing line is the `current_user_can('edit_post', $post_id)` check. Without that capability check, the plugin accepts any `post_id` supplied by the request and proceeds to modify the referenced post. The `is_user_logged_in()` branch is also necessary to stop unauthenticated users from submitting a `post_id`, but the actual authorization decision for existing posts comes from `current_user_can()`. The remaining lines support the guard: `if (!empty($post_id))` scopes the capability check to updates only, and the `die(json_encode($response))` exits early on unauthorized access.

## Hardening Checklist
- Use `current_user_can('edit_post', $post_id)` before updating any post from an AJAX handler.
- Block guest edits entirely with `is_user_logged_in()` when the endpoint is supposed to update existing content.
- Add `check_ajax_referer()` / `wp_verify_nonce()` to AJAX entry points that mutate data.
- Validate numeric post IDs with `intval()` and confirm existence with `get_post($post_id)` before applying changes.
- Separate guest submission endpoints from post-editing endpoints so `post_id` is never trusted in a public form handler.

## References
- https://nvd.nist.gov/vuln/detail/CVE-2025-14080

CVE CVE-2025-14080

PRODUCT Folder Analysis

AFFECTED ≤ cache/frontend-post-submission-manager-lite_1.2.5

FIXED IN cache/frontend-post-submission-manager-lite_1.2.6

STATUS Generated

Security writeup · CVE-2025-14080

Source files · 1

includes/cores/ajax-process-form.php Linked

↗ NVD