CVE-2025-24737: WP Helper Premium Auth Bypass Vulnerability

CVE-2025-24737 Overview

CVE-2025-24737 is a missing authorization vulnerability [CWE-862] in the Mat Bao Corporation WP Helper Premium plugin for WordPress. The flaw affects the wp-helper-lite codebase in all versions up to and including 4.6.1. Attackers can access functionality that is not properly constrained by access control lists (ACLs) over the network without authentication or user interaction. The issue is classified as broken access control and can lead to limited disclosure of information and unauthorized modification of plugin data on affected WordPress sites.

Critical Impact
Unauthenticated remote attackers can invoke restricted plugin functionality on WordPress sites running WP Helper Premium up to version 4.6.1.

Affected Products

Mat Bao Corporation WP Helper Premium plugin
WordPress sites using the wp-helper-lite plugin
All versions from n/a through <= 4.6.1

Discovery Timeline

2025-04-17 - CVE-2025-24737 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24737

Vulnerability Analysis

The WP Helper Premium plugin exposes one or more action handlers that fail to verify the caller's authorization state before executing privileged operations. Under [CWE-862], the plugin registers endpoints — typically through admin-ajax.php, REST API routes, or admin_post hooks — without validating that the requesting user holds the required capability. The flaw permits unauthenticated network requests to reach code paths that should be restricted to administrators or authenticated users.

The attack surface is reachable remotely with low complexity. Successful exploitation results in limited confidentiality and integrity impact, consistent with reading or modifying plugin-managed data without triggering availability loss. The EPSS score is 0.29% at the 21st percentile, indicating a low current probability of observed exploitation.

Root Cause

The root cause is the absence of capability checks such as current_user_can() and nonce verification via check_admin_referer() or wp_verify_nonce() on action handlers registered by the plugin. Handlers that mutate or read plugin state execute regardless of the caller's role. WordPress hook registrations that use the nopriv variant, for example wp_ajax_nopriv_{action}, further expose these endpoints to unauthenticated visitors.

Attack Vector

An attacker sends crafted HTTP requests directly to the vulnerable plugin endpoints on a target WordPress site. No credentials, tokens, or user interaction are required. The request invokes plugin functionality that should be gated behind administrative privileges, yielding partial disclosure of site or plugin data and permitting unauthorized state changes constrained to the plugin's scope.

Refer to the Patchstack Vulnerability Report for endpoint-specific details.

Detection Methods for CVE-2025-24737

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php referencing WP Helper Premium action parameters.
Requests to plugin REST routes originating from IP addresses that never authenticated to /wp-login.php.
Unexpected modifications to plugin settings, options rows in wp_options, or plugin-managed database tables.

Detection Strategies

Inventory WordPress installations and flag any running wp-helper-lite at version 4.6.1 or earlier.
Review web server access logs for repeated requests to plugin action handlers without a corresponding authenticated session cookie.
Correlate WordPress audit logs against expected administrator activity to identify anomalous configuration changes.

Monitoring Recommendations

Enable a WordPress security or audit-log plugin to record option changes, user role modifications, and plugin action invocations.
Alert on HTTP 200 responses to admin-ajax.php requests that carry no valid wordpress_logged_in_* cookie.
Monitor outbound requests originating from the WordPress host that could indicate follow-on abuse after unauthorized configuration changes.

How to Mitigate CVE-2025-24737

Immediate Actions Required

Identify all WordPress sites running WP Helper Premium and confirm the installed version.
Update the plugin to a fixed release once Mat Bao Corporation publishes a version above 4.6.1.
Restrict administrative endpoints behind a web application firewall (WAF) rule blocking anonymous access to plugin-specific action names.
Audit wp_options and plugin-managed tables for unauthorized changes and revert as needed.

Patch Information

A fixed version above 4.6.1 must be installed once released by the vendor. Consult the Patchstack Vulnerability Report for the authoritative patched version and vendor advisory links.

Workarounds

Deactivate and remove the WP Helper Premium plugin until a patched version is available.
Deploy WAF rules that block unauthenticated requests to admin-ajax.php carrying plugin-specific action parameters.
Restrict access to /wp-admin/ by IP allow-list where operationally feasible.

bash

# Configuration example: block unauthenticated access to plugin AJAX actions
# Example nginx snippet — adapt action names to those disclosed by the vendor advisory
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^(wp_helper_|wphelper_)") {
        # Require a logged-in WordPress cookie
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}