CVE-2025-22695: Nirweb Support Auth Bypass Vulnerability

CVE-2025-22695 Overview

CVE-2025-22695 is an Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in the NirWp Team Nirweb Support plugin for WordPress. The flaw affects all versions of the nirweb-support plugin up to and including 3.0.3. Authenticated attackers with low privileges can manipulate user-controlled identifiers to access or modify resources belonging to other users, resulting in broken access control across the plugin's functionality.

Critical Impact
Authenticated attackers with low-level privileges can bypass authorization checks over the network to access data belonging to other users of the plugin.

Affected Products

NirWp Team Nirweb Support plugin for WordPress
All versions from n/a through 3.0.3
WordPress sites running the nirweb-support plugin

Discovery Timeline

2025-02-03 - CVE-2025-22695 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22695

Vulnerability Analysis

The vulnerability is classified as Authorization Bypass Through User-Controlled Key, which corresponds to the Insecure Direct Object Reference (IDOR) pattern documented in CWE-639. The Nirweb Support plugin exposes functionality that references internal objects such as ticket IDs, user IDs, or resource identifiers directly in requests. The plugin fails to validate that the authenticated requester owns or is authorized to interact with the referenced object.

An attacker with a valid low-privileged account can substitute another user's identifier in a request and the plugin will process the operation as if the attacker were authorized. The confidentiality impact is limited to information the plugin manages, and the integrity impact is limited to records the plugin can modify. Availability is not affected. See the Patchstack Vulnerability Report for coordinated disclosure details.

Root Cause

The root cause is missing or insufficient authorization checks on request handlers that accept user-supplied identifiers. The plugin trusts the value of an object key provided by the client instead of comparing it against the session owner or performing a capability check. This allows one authenticated user to reference records owned by another.

Attack Vector

Exploitation requires network access and a low-privileged authenticated session on the target WordPress site. No user interaction is required. An attacker crafts requests to plugin endpoints while substituting a target's identifier in parameters such as ticket IDs or user references, then receives or modifies data belonging to the target account.

No public proof-of-concept code has been published. The Patchstack Vulnerability Report describes the broken access control pattern used to trigger the flaw.

Detection Methods for CVE-2025-22695

Indicators of Compromise

Requests to nirweb-support plugin endpoints containing object identifiers that do not match the authenticated user's own records.
Repeated sequential or enumerated identifier values submitted by a single authenticated session, indicating IDOR probing.
Unexpected read or write operations on support tickets or user records from accounts that should not have access.

Detection Strategies

Review WordPress access logs for POST or GET requests to nirweb-support endpoints and correlate the referenced object IDs against the authenticated user ID.
Enable WordPress debug logging or plugin-level audit logging to capture requests that reference records owned by other users.
Deploy a Web Application Firewall (WAF) rule that flags suspicious enumeration patterns against plugin URLs.

Monitoring Recommendations

Monitor authenticated sessions for high-frequency requests to plugin resource endpoints.
Alert on account activity that reads or edits support records outside the account's normal scope.
Track plugin version inventory across WordPress deployments to identify hosts still running nirweb-support 3.0.3 or earlier.

How to Mitigate CVE-2025-22695

Immediate Actions Required

Update the Nirweb Support plugin to a version later than 3.0.3 once the vendor publishes a fix.
Audit existing subscriber and low-privileged accounts on WordPress sites running the plugin and remove unused accounts.
Review support ticket and user data handled by the plugin for unauthorized access or modification.

Patch Information

At the time of publication, the Patchstack Vulnerability Report is the authoritative source for remediation status. Administrators should consult the vendor's plugin page on the WordPress plugin repository for the latest patched release and apply the update through the WordPress admin dashboard or WP-CLI.

Workarounds

Deactivate and remove the nirweb-support plugin until a patched version is available if the plugin is not business critical.
Restrict registration on affected WordPress sites to reduce the pool of low-privileged accounts that could exploit the flaw.
Apply WAF rules that enforce ownership checks on request parameters used by the plugin's endpoints.

bash

# Disable the vulnerable plugin using WP-CLI until a fix is available
wp plugin deactivate nirweb-support
wp plugin list --name=nirweb-support --fields=name,status,version