CVE-2025-5018 Overview
CVE-2025-5018 is a missing authorization vulnerability in the Hive Support plugin for WordPress affecting all versions up to and including 1.2.5. The flaw resides in the hs_update_ai_chat_settings() and hive_lite_support_get_all_binbox() functions, which lack proper capability checks. Authenticated users with Subscriber-level access or higher can read and overwrite the site's OpenAI API key, access inspection data, and modify AI-chat prompts and behavior. The issue is tracked under [CWE-862: Missing Authorization] and may be a duplicate of CVE-2025-32208 or CVE-2025-32242.
Critical Impact
Low-privileged authenticated attackers can exfiltrate OpenAI API keys and manipulate AI chat behavior on affected WordPress sites.
Affected Products
- Hive Support plugin for WordPress, all versions up to and including 1.2.5
- WordPress sites with the Hive Support plugin enabled
- Sites integrating OpenAI through the Hive Support plugin
Discovery Timeline
- 2025-06-06 - CVE-2025-5018 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5018
Vulnerability Analysis
The Hive Support plugin exposes AJAX handlers that perform sensitive operations without verifying the caller's WordPress capabilities. The hs_update_ai_chat_settings() function writes AI configuration data, including the OpenAI API key and chat prompt definitions. The hive_lite_support_get_all_binbox() function returns inspection data and stored configuration values to the requester.
Both functions check that a request is authenticated, but neither validates that the calling user holds an administrative capability such as manage_options. WordPress treats any logged-in user, including Subscribers, as authenticated. The attack vector requires network access and low privileges, with no user interaction needed.
Root Cause
The root cause is a missing capability check [CWE-862] in the plugin's AJAX endpoints. The handlers registered via wp_ajax_* hooks rely on authentication alone rather than calling current_user_can() to enforce role-based access. As a result, the privilege boundary between Subscriber and Administrator collapses for these endpoints.
Attack Vector
An attacker registers or compromises a Subscriber-level account on a target WordPress site. The attacker then issues authenticated POST requests to the affected admin-ajax.php endpoints invoking the vulnerable actions. The hive_lite_support_get_all_binbox() call returns the OpenAI API key stored in plugin options. The hs_update_ai_chat_settings() call overwrites the API key, system prompt, or model configuration. Modified prompts can redirect AI chat output to attacker-controlled responses or leak conversation data.
Detection Methods for CVE-2025-5018
Indicators of Compromise
- Unexpected POST requests to admin-ajax.php referencing Hive Support actions from non-administrator accounts
- Modifications to the Hive Support ai_chat_settings option without a corresponding administrator session
- OpenAI API usage spikes or billing anomalies tied to the site's API key
- New or recently active Subscriber accounts issuing AJAX traffic to plugin endpoints
Detection Strategies
- Audit WordPress access logs for action=hs_update_ai_chat_settings and related Hive Support AJAX actions originating from low-privilege sessions
- Compare current plugin option values against a known-good baseline for AI prompt and API key fields
- Enable WordPress audit logging plugins to track changes to the wp_options table entries owned by Hive Support
- Rotate the OpenAI API key and monitor whether the leaked key continues to be used externally
Monitoring Recommendations
- Alert on Subscriber-role users invoking administrative AJAX actions on admin-ajax.php
- Monitor outbound OpenAI API call volume and error rates for sudden deviations
- Track creation of new low-privilege WordPress accounts followed by AJAX traffic to plugin endpoints
How to Mitigate CVE-2025-5018
Immediate Actions Required
- Update the Hive Support plugin to a version newer than 1.2.5 that includes the fix from changeset #3311984
- Rotate the OpenAI API key stored in the plugin and invalidate any previously exposed key
- Review and remove untrusted Subscriber-level accounts from the WordPress installation
- Inspect plugin AI chat settings for unauthorized prompt or model modifications and restore expected values
Patch Information
The maintainers addressed the issue in WordPress Changeset #3311984. Refer to the Wordfence Vulnerability Advisory and the Hive Support plugin page for the latest patched release. The vulnerable code paths are referenced in the Hive Support AJAX handler source.
Workarounds
- Disable the Hive Support plugin until the patched version can be installed
- Restrict registration on WordPress sites where open Subscriber signup is not required
- Apply a Web Application Firewall rule blocking unauthenticated or low-privilege calls to the affected AJAX actions
- Remove the OpenAI API key from plugin configuration until the site is patched and accounts are reviewed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
