CVE-2025-0856: WordPress PGS Core Auth Bypass Flaw

CVE-2025-0856 Overview

CVE-2025-0856 is a missing authorization vulnerability [CWE-862] in the PGS Core plugin for WordPress, developed by Potenza Global Solutions. The flaw affects all versions up to and including 5.8.0. Multiple plugin functions lack capability checks, allowing unauthenticated attackers to add or modify plugin options over the network. The vulnerability impacts data integrity, confidentiality, and availability of WordPress sites running the affected plugin. The Exploit Prediction Scoring System (EPSS) places this issue in the 67th percentile of vulnerabilities by likelihood of exploitation.

Critical Impact

Unauthenticated attackers can modify plugin options remotely, leading to unauthorized site configuration changes and potential data loss.

Affected Products

• PGS Core plugin for WordPress, all versions through 5.8.0
• WordPress sites bundling the CiyaShop theme ecosystem from Potenza Global Solutions
• Any installation exposing the plugin endpoints to unauthenticated network traffic

Discovery Timeline

• 2025-05-06 - CVE-2025-0856 published to the National Vulnerability Database
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-0856

Vulnerability Analysis

The PGS Core plugin exposes multiple administrative functions that handle plugin option management. These functions do not perform current_user_can() capability checks or verify nonce values before executing privileged operations. As a result, any unauthenticated requester can invoke these endpoints to add, modify, or remove plugin options stored in the WordPress database.

The vulnerability falls under the Missing Authorization weakness class [CWE-862]. It enables tampering with stored configuration data that downstream code trusts as administrator-supplied input. Depending on which options are altered, attackers can degrade site functionality, redirect users, or stage follow-on attacks against authenticated administrators.

Root Cause

The root cause is the absence of authorization checks on AJAX or REST handlers that mutate plugin options. WordPress plugins must gate state-changing actions behind capability validation and nonce verification. The affected handlers register callbacks accessible via wp-admin/admin-ajax.php without these guards, treating any caller as authorized.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends crafted HTTP POST requests to the vulnerable AJAX endpoints registered by the PGS Core plugin. No authentication, user interaction, or elevated privileges are needed. The attacker can write attacker-controlled values into the wp_options table entries managed by the plugin.

Refer to the Wordfence Vulnerability Report for technical details on the affected functions.

Detection Methods for CVE-2025-0856

Indicators of Compromise

• Unexpected modifications to plugin option rows in the wp_options table associated with PGS Core or CiyaShop configuration
• Unauthenticated POST requests to admin-ajax.php with action parameters tied to PGS Core handlers
• New or altered site settings, redirects, or theme options without a corresponding administrator login event

Detection Strategies

• Inspect web server access logs for repeated POST requests to admin-ajax.php lacking valid session cookies
• Audit the wp_options table for unexpected changes to keys managed by the PGS Core plugin
• Correlate WordPress audit log entries for option updates against authenticated administrative sessions

Monitoring Recommendations

• Enable a WordPress activity logging plugin to record option changes and originating IP addresses
• Forward web server and PHP error logs to a centralized SIEM for query-based anomaly detection
• Alert on high-volume unauthenticated traffic targeting WordPress AJAX or REST endpoints

How to Mitigate CVE-2025-0856

Immediate Actions Required

• Identify all WordPress sites with the PGS Core plugin installed and confirm the installed version
• Update the PGS Core plugin to a version above 5.8.0 once the vendor releases a fix
• Restrict access to wp-admin/admin-ajax.php from untrusted networks where feasible
• Review the wp_options table for unauthorized modifications and restore from known-good backups if tampering is found

Patch Information

Refer to the Potenza Global Solutions Changelog for the latest plugin release notes and patch availability. Apply the vendor-supplied update that adds capability checks to the affected handlers as soon as it is available.

Workarounds

• Deactivate the PGS Core plugin until a patched version is installed
• Deploy a web application firewall rule blocking unauthenticated requests to the vulnerable AJAX actions
• Limit administrative interface exposure with IP allowlisting at the web server or reverse proxy layer

# Example WAF rule concept blocking unauthenticated PGS Core AJAX actions
# (adapt action names to those identified in the Wordfence advisory)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1000856,msg:'Block unauth PGS Core action'"
  SecRule ARGS:action "@rx ^(pgs_|ciyashop_)" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"