CVE-2025-5117 Overview
CVE-2025-5117 is a privilege escalation vulnerability in the Property plugin for WordPress, affecting versions 1.0.5 through 1.0.6. The flaw stems from a missing capability check on the property_package_user_role metadata, classified as [CWE-862] Missing Authorization. Authenticated attackers with Author-level access or higher can elevate their privileges to administrator. The attack involves creating a package post with the property_package_user_role value set to administrator and then submitting the PayPal registration form. Successful exploitation grants full administrative control over the affected WordPress site.
Critical Impact
Authenticated users with Author privileges can escalate to administrator, leading to full site takeover, arbitrary content modification, and persistent backdoor installation.
Affected Products
- WordPress Property plugin version 1.0.5
- WordPress Property plugin version 1.0.6
- WordPress sites using the Property plugin with PayPal registration enabled
Discovery Timeline
- 2025-05-27 - CVE-2025-5117 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-5117
Vulnerability Analysis
The Property plugin allows users to create package posts that include a property_package_user_role post meta value. This meta value defines the role assigned to a user during PayPal-based registration. The plugin reads this meta value from the package post and applies it directly to the registering user without verifying that the package creator had authority to assign that role. Because Author-level accounts can create posts in WordPress, an attacker with that role can craft a malicious package post containing administrator in the property_package_user_role field. Submitting the PayPal registration flow against that package then assigns administrator privileges to the attacker-controlled account.
Root Cause
The root cause is a missing capability check in the PayPal submission handler located in admin/pages/payment-inc/paypal-submit.php. The handler trusts the role value stored in the package post meta without validating whether the original package author held the promote_users or equivalent administrative capability. This is a classic broken access control pattern where authorization data is sourced from attacker-controllable storage.
Attack Vector
Exploitation requires an authenticated session at the Author role or above on a vulnerable WordPress site. The attacker performs the following sequence: first, they create a new package custom post type and set its property_package_user_role meta to administrator. Second, they trigger the PayPal registration handler referenced in paypal-submit.php, which reads the meta value and elevates the registering account. No user interaction by an administrator is required, and the attack is fully network-reachable.
No verified public proof-of-concept code is currently available. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Payment Page Code for technical details on the vulnerable code path.
Detection Methods for CVE-2025-5117
Indicators of Compromise
- Unexpected new administrator accounts in the WordPress wp_users and wp_usermeta tables following PayPal registration events.
- Package custom post type entries containing administrator in the property_package_user_role post meta value.
- Web server logs showing POST requests to the PayPal submission endpoint originating from Author-level sessions.
- Audit log entries indicating role changes immediately following package post creation by non-administrative users.
Detection Strategies
- Query the wp_postmeta table for any record where meta_key = 'property_package_user_role' and meta_value = 'administrator', then correlate the parent post author against actual administrators.
- Alert on WordPress role transitions where a user's capability set changes from author or lower to administrator outside of authorized provisioning workflows.
- Inspect access logs for sequential requests creating a package post followed by paypal-submit.php invocations from the same session.
Monitoring Recommendations
- Enable WordPress audit logging for post creation, post meta updates, and role assignments.
- Forward WordPress and web server logs to a centralized log analytics platform for retention and correlation.
- Periodically enumerate users with the administrator role and validate each against an approved roster.
How to Mitigate CVE-2025-5117
Immediate Actions Required
- Update the Property plugin to a version higher than 1.0.6 that incorporates the fix introduced in WordPress Changeset #3299714.
- Audit all administrator accounts and remove any that cannot be tied to a legitimate provisioning event.
- Review all package posts and delete or sanitize entries where property_package_user_role is set to a privileged role.
- Rotate credentials and API keys for any account that may have been compromised through escalation.
Patch Information
The vendor addressed the missing capability check in the WordPress Property plugin source tree. See WordPress Changeset #3299714 for the committed fix and the WordPress Property Plugin Documentation for the current release. Site operators should install the patched version through the standard WordPress plugin update mechanism.
Workarounds
- Deactivate the Property plugin until the patched version is installed if PayPal-based registration is not business-critical.
- Restrict Author-level and higher accounts to trusted users only, and enforce strong authentication to limit who can reach the vulnerable code path.
- Apply a web application firewall rule that blocks requests to paypal-submit.php when the referenced package post contains an administrator role meta value.
# Configuration example: identify vulnerable package posts via WP-CLI
wp post meta list --format=table --keys=property_package_user_role \
| grep -i administrator
# Disable the plugin until patched
wp plugin deactivate property
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
