Exploitation Research Plan: CVE-2025-15043 (The Events Calendar)

1. Vulnerability Summary

The The Events Calendar plugin (up to 6.15.13) contains a missing authorization vulnerability in its Custom Tables V1 migration logic. Specifically, the functions start_migration, cancel_migration, and revert_migration fail to perform adequate capability checks (e.g., current_user_can( 'manage_options' )). While they may implement nonce verification, the nonces are often exposed to any authenticated user within the WordPress admin dashboard. This allows a Subscriber-level user to manipulate the core database state of the plugin, potentially leading to data loss via the revert_migration action, which drops custom database tables.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action Names (Inferred):
  • tribe_custom_tables_v1_start_migration
  • tribe_custom_tables_v1_cancel_migration
  • tribe_custom_tables_v1_revert_migration
• HTTP Method: POST
• Authentication: Authenticated (Subscriber or higher).
• Vulnerable Parameters: action and nonce.
• Preconditions: The site must be using (or eligible for) the Custom Tables V1 migration.

3. Code Flow

1. Entry Point: A logged-in user sends a request to admin-ajax.php with one of the migration actions.
2. Hook Registration: The plugin registers AJAX handlers using add_action( 'wp_ajax_...' ).
3. Vulnerable Functions: These are likely located within a migration-specific class, such as Tribe\Events\Custom_Tables\V1\Migration\Admin_Handler or similar.
4. Processing:
   • The handler calls check_ajax_referer( 'tribe_custom_tables_v1_migration_action', 'nonce' ) (inferred action string).
   • The Bug: After the nonce check, the code immediately calls the migration logic without verifying if the user has manage_options or tec_manage_settings capabilities.
5. Sink: The revert_migration function executes SQL commands like DROP TABLE on the custom events tables.

4. Nonce Acquisition Strategy

The migration logic is an admin feature. WordPress enqueues the necessary scripts and localizes the nonces for these actions in the admin dashboard.

1. Identify the Script: Look for wp_localize_script calls that include the migration nonce.
2. Target Variable (Inferred): Search for tribe_migration_v1 or tribe_events_migration.
3. Execution Steps:
   • Log in as a Subscriber.
   • Navigate to the WordPress Dashboard (/wp-admin/index.php). Most global plugin scripts are loaded across the admin area.
   • Use browser_eval to extract the nonce:

     // Example based on typical plugin patterns
     window.tribe_migration_data?.nonce 
     // OR
     window.TribeEventsMigration?.nonce
     

   • If the script is only loaded on specific pages, search for where wp_enqueue_script is called for the migration UI and navigate there.

5. Exploitation Strategy

Goal: Trigger revert_migration as a Subscriber to drop custom tables.

1. Step 1: Discover Exact Action and Nonce:

   • Search the codebase for add_action( 'wp_ajax_ combined with migration.
   • Identify the nonce action string used in check_ajax_referer.
   • Identify the JS object name used in wp_localize_script.

2. Step 2: Session Setup:

   • Authenticate as a Subscriber and save cookies.

3. Step 3: Extract Nonce:

   • Use browser_navigate to /wp-admin/index.php.
   • Use browser_eval to fetch the nonce from the identified JS object.

4. Step 4: Execute Revert Action:

   • Send a POST request to admin-ajax.php:
     • URL: http://localhost:8080/wp-admin/admin-ajax.php
     • Headers: Content-Type: application/x-www-form-urlencoded
     • Body: action=tribe_custom_tables_v1_revert_migration&nonce=[EXTRACTED_NONCE] (Adjust action name based on Step 1).

6. Test Data Setup

1. Install Plugin: Install The Events Calendar version 6.15.0 (vulnerable).
2. Populate Events: Create 5-10 events to ensure there is data to migrate.
3. Enable Custom Tables: Ensure the Custom Tables migration has been completed or is in a state where "Revert" is a valid state.
   • Note: You may need to use wp tribe migrations migrate via CLI to reach the state where revert is possible.
4. Create Attacker: wp user create attacker attacker@example.com --role=subscriber --user_pass=password123.

7. Expected Results

• Response: The AJAX endpoint should return a success message (e.g., {"success":true}) or a 200 OK indicating the migration process was altered.
• Database Impact: The custom tables (e.g., wp_tec_occurrences, wp_tec_event_meta) should be dropped or flagged for deletion.

8. Verification Steps

1. Database Check:
   • Before exploit: wp db query "SHOW TABLES LIKE '%tec_%'" should show custom tables.
   • After exploit: Run the same command; the tables should be missing.
2. Option Check:
   • wp option get tribe_custom_tables_migration_status should reflect a "reverting" or "cancelled" state.

9. Alternative Approaches

• Start Migration: If "Revert" is not available, try start_migration. This will trigger a resource-intensive background process, which is a form of Denial of Service (DoS)/Integrity violation.
• REST API: Check if the plugin registered REST API endpoints for migration (/wp-json/tribe/v1/migration/...). If so, check for a permission_callback that returns true or fails to check capabilities. These would use the wp_rest nonce instead.