CVE-2025-15157: WordPress Starfish Plugin Privilege Escalation

CVE-2025-15157 Overview

The Starfish Review Generation & Marketing for WordPress plugin is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the srm_restore_options_defaults function in all versions up to, and including, 3.1.19. This missing authorization vulnerability (CWE-862) allows authenticated attackers with Subscriber-level access and above to update arbitrary options on the WordPress site, ultimately enabling them to gain administrative access.

Critical Impact

Attackers with minimal Subscriber-level access can escalate privileges to administrator by modifying WordPress registration settings, enabling unauthorized administrative access to vulnerable sites.

Affected Products

• Starfish Review Generation & Marketing for WordPress plugin versions up to and including 3.1.19
• WordPress installations running vulnerable versions of the Starfish Reviews plugin

Discovery Timeline

• 2026-02-13 - CVE CVE-2025-15157 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-15157

Vulnerability Analysis

This vulnerability stems from a missing capability check within the srm_restore_options_defaults function located in the plugin's AJAX callback handler (starfish-ajax-callbacks.action.php). The function is designed to restore plugin settings to their default values, but fails to verify that the requesting user has appropriate administrative privileges before executing.

The absence of proper authorization controls allows any authenticated user, including those with the lowest privilege level (Subscriber), to invoke this function and manipulate WordPress site options. The attack leverages the exposed AJAX endpoint to modify critical site settings, particularly those governing user registration and default user roles.

Root Cause

The root cause is a missing capability check (CWE-862) in the srm_restore_options_defaults function. WordPress plugins must implement proper capability verification using functions like current_user_can() before executing privileged operations. The vulnerable function processes AJAX requests without confirming that the authenticated user possesses administrative privileges, thereby allowing low-privileged users to perform actions that should be restricted to administrators.

Attack Vector

The attack is network-based and requires low-privilege authenticated access. An attacker with a valid Subscriber account can exploit this vulnerability through the following mechanism:

The attacker sends a crafted AJAX request to the WordPress site targeting the srm_restore_options_defaults action. Due to the missing capability check, the request is processed regardless of the user's actual privilege level. The attacker can modify the default_role option to set it to "administrator" and enable the users_can_register option. Once these settings are changed, the attacker can create a new user account through the normal registration process, which will automatically be assigned administrator privileges. This grants full control over the WordPress installation.

Detection Methods for CVE-2025-15157

Indicators of Compromise

• Unexpected changes to the WordPress default_role option, particularly if set to administrator
• User registration being enabled when it was previously disabled
• New administrator accounts appearing without legitimate authorization
• AJAX requests to admin-ajax.php with action parameter srm_restore_options_defaults from non-administrative users

Detection Strategies

• Monitor WordPress options table for unauthorized modifications to default_role and users_can_register settings
• Review web server access logs for suspicious POST requests to admin-ajax.php containing Starfish plugin AJAX actions
• Audit user creation events and verify all new administrator accounts are legitimate
• Implement WordPress security plugins that monitor option changes and alert on unexpected modifications

Monitoring Recommendations

• Enable comprehensive logging for WordPress AJAX requests and option updates
• Configure alerts for any changes to user registration settings or default role assignments
• Regularly audit the list of administrator accounts and investigate any unexpected additions
• Monitor authentication events for patterns indicating exploitation attempts

How to Mitigate CVE-2025-15157

Immediate Actions Required

• Update the Starfish Review Generation & Marketing plugin to the latest patched version immediately
• Audit current WordPress administrator accounts and remove any unauthorized users
• Review and verify the current default_role setting is appropriate (typically "subscriber")
• Confirm that users_can_register is set according to your site's requirements
• Consider temporarily deactivating the plugin until a patch can be applied

Patch Information

A patched version addressing this missing capability check vulnerability should be obtained from the WordPress plugin repository. Review the WordPress Starfish Plugin Code and the Wordfence Vulnerability Report for additional details on the vulnerability and remediation steps.

Workarounds

• If immediate patching is not possible, deactivate the Starfish Reviews plugin until a secure version is available
• Implement a Web Application Firewall (WAF) rule to block AJAX requests containing the srm_restore_options_defaults action parameter
• Restrict Subscriber account creation and review existing Subscriber accounts for legitimacy
• Add custom capability checks via a security plugin or mu-plugin to protect the vulnerable endpoint

# WordPress CLI commands to verify and reset affected settings
# Check current default role setting
wp option get default_role

# Reset default role to subscriber if compromised
wp option update default_role subscriber

# Check if user registration is enabled
wp option get users_can_register

# Disable user registration if unexpectedly enabled
wp option update users_can_register 0

# List all administrator users to audit for unauthorized accounts
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered