Employee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.3 - Missing Authorization to Authenticated (Subscriber+) Tracking Opt-In/Opt-Out Modification

This research plan outlines the technical steps to analyze and exploit CVE-2025-13403, a missing authorization vulnerability in the "Employee Spotlight" WordPress plugin.

---

1. Vulnerability Summary

• Vulnerability: Missing Authorization
• Affected Function: employee_spotlight_check_optin()
• Plugin Slug: employee-spotlight
• Description: The plugin fails to perform a capability check (e.g., current_user_can('manage_options')) within the employee_spotlight_check_optin() function. This function handles AJAX requests to modify the plugin's usage tracking settings. As a result, any authenticated user with Subscriber-level permissions or higher can enable or disable the plugin's tracking features.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• HTTP Method: POST
• AJAX Action: employee_spotlight_check_optin (inferred from function name)
• Required Parameter: optin or status (inferred) to specify the tracking state.
• Authentication: Authenticated (Subscriber-level or higher).
• Preconditions: The plugin must be active.

3. Code Flow (Inferred)

1. The plugin registers an AJAX action for authenticated users:
   add_action( 'wp_ajax_employee_spotlight_check_optin', 'employee_spotlight_check_optin' );
2. A Subscriber sends a POST request to admin-ajax.php with action=employee_spotlight_check_optin.
3. WordPress core invokes the employee_spotlight_check_optin() function.
4. The Flaw: The function processes the request and updates a WordPress option (e.g., employee_spotlight_tracking) without verifying if the current user has administrative privileges.
5. The setting is modified in the wp_options table.

4. Nonce Acquisition Strategy

The plugin likely uses a nonce to prevent CSRF, and since Subscribers can access the wp-admin dashboard, the nonce is likely localized for them.

1. Identify Localization: Search the plugin source for wp_localize_script.
2. Target Script: Look for a script registered for the admin dashboard (e.g., employee-spotlight-admin-js).
3. Extraction:
   • Log in to the WordPress dashboard as a Subscriber.
   • The nonce is likely contained in a global JavaScript object. Common names would be employee_spotlight_admin or es_ajax.
   • Use browser_eval to extract it:
     browser_eval("window.employee_spotlight_admin?.nonce") or browser_eval("window.es_vars?.nonce").

Note: If the plugin uses check_ajax_referer with a specific action string, that string must be used. If the check is missing entirely, no nonce is needed.

5. Exploitation Strategy

1. Preparation:
   • Identify the exact option name used by the plugin for tracking (search for update_option inside employee_spotlight_check_optin).
2. Authentication: Use the http_request tool to log in as a Subscriber and obtain session cookies.
3. Nonce Retrieval: Use browser_navigate and browser_eval as described above to find the valid nonce.
4. Payload Delivery:
   • Send a POST request to /wp-admin/admin-ajax.php.
   • Body (URL-encoded):
     action=employee_spotlight_check_optin&nonce=[NONCE]&optin=true (or false to disable).
   • Headers: Include the Subscriber's Cookie header.
5. Target Verification: Observe the JSON response (e.g., {"success": true}).

6. Test Data Setup

1. Environment: A standard WordPress installation with the employee-spotlight plugin (version <= 5.1.3).
2. User Creation: Create a user with the subscriber role.
   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
3. Baseline Check: Check the current value of the tracking option.
   wp option get employee_spotlight_tracking (or the actual option name found in the code).

7. Expected Results

• The AJAX request returns a success status (HTTP 200 and likely a JSON body).
• The WordPress option governing plugin tracking is updated to the value specified in the attack payload.

8. Verification Steps

After the HTTP exploit, use WP-CLI to confirm the state change:

1. wp option get [OPTION_NAME]
2. Compare the value with the baseline check performed in Step 6. If the value has changed according to the payload, the exploit is successful.

9. Alternative Approaches

• Action Search: If employee_spotlight_check_optin is not the AJAX action, grep the codebase for wp_ajax_ to find the correct registration.
• Option Enumeration: If the specific option name is unclear, use wp option list --search="*employee*" to find related settings.
• Authorization Check Check: If the exploit fails, verify if employee_spotlight_check_optin is actually hooked to admin_init instead of wp_ajax. If it's on admin_init, it might execute on every admin page load if a specific parameter is present.