CVE-2025-5288: WordPress REST API Plugin Escalation Flaw

CVE-2025-5288 Overview

CVE-2025-5288 is a Privilege Escalation vulnerability affecting the REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress. The vulnerability exists due to a missing capability check on the process_handler() function in versions 1.0.0 to 2.0.3. This flaw allows unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON data, and create a new user with full Administrator privileges.

Critical Impact

Unauthenticated attackers can exploit this vulnerability to gain full administrative access to WordPress sites by creating rogue administrator accounts, leading to complete site takeover.

Affected Products

• REST API | Custom API Generator For Cross Platform And Import Export In WP plugin versions 1.0.0 to 2.0.3
• WordPress installations using the vulnerable plugin versions

Discovery Timeline

• June 13, 2025 - CVE-2025-5288 published to NVD
• June 16, 2025 - Last updated in NVD database

Technical Details for CVE-2025-5288

Vulnerability Analysis

This vulnerability represents a classic Missing Authorization flaw (CWE-862) in the WordPress plugin ecosystem. The process_handler() function, located in wot-rapi-import-functions.php, fails to verify that the requesting user has appropriate permissions before processing import requests. This architectural oversight allows any unauthenticated visitor to invoke the import functionality that should be restricted to administrators only.

The attack is particularly dangerous because it enables complete privilege escalation from an anonymous user to a full administrator without any authentication credentials. Once an attacker gains administrative access, they can install malicious plugins, modify site content, access sensitive data, or use the compromised site as a launching point for further attacks.

Root Cause

The root cause is the absence of a capability check within the process_handler() function. WordPress provides built-in functions such as current_user_can() to verify user permissions before executing privileged operations. The vulnerable code path processes import requests without validating that the caller has administrative capabilities, effectively treating all requests—including those from unauthenticated users—as authorized.

Attack Vector

The attack is network-based and requires no user interaction or authentication. An attacker can craft a malicious HTTP POST request to the plugin's endpoint with a specially formatted JSON payload containing user creation data. The payload specifies an import_api URL pointing to attacker-controlled JSON that includes parameters to create a new user account with the administrator role.

The vulnerable function at line 123 of wot-rapi-import-functions.php processes the import without authorization checks. Technical details are available in the WordPress Plugin Function Code.

Detection Methods for CVE-2025-5288

Indicators of Compromise

• Unexpected administrator accounts appearing in the WordPress user database
• Suspicious POST requests to REST API import endpoints from external IPs
• Unusual user creation events in WordPress activity logs without corresponding admin actions
• JSON import activity originating from untrusted or external URLs

Detection Strategies

• Monitor WordPress access logs for POST requests targeting the plugin's import endpoints from unauthenticated sessions
• Implement Web Application Firewall (WAF) rules to detect and block requests containing user creation payloads in JSON format
• Review WordPress user tables regularly for unauthorized administrator accounts
• Enable and monitor WordPress audit logging for user creation events

Monitoring Recommendations

• Configure alerting for new administrator account creation outside of normal administrative workflows
• Set up file integrity monitoring on the vulnerable plugin directory
• Monitor outbound connections from the WordPress server that may indicate attacker-controlled import_api URLs being fetched
• Review authentication logs for login attempts using newly created accounts

How to Mitigate CVE-2025-5288

Immediate Actions Required

• Update the REST API | Custom API Generator For Cross Platform And Import Export In WP plugin to a version newer than 2.0.3 immediately
• Audit your WordPress user database for any unauthorized administrator accounts and remove them
• Review site activity logs for evidence of exploitation and unauthorized access
• Consider temporarily deactivating the plugin until the update is applied

Patch Information

The vulnerability affects versions 1.0.0 through 2.0.3 of the plugin. Site administrators should update to the latest patched version available from the WordPress Plugin Developer Page. Additional vulnerability details and remediation guidance are available from the Wordfence Vulnerability Report.

Workarounds

• Disable or uninstall the vulnerable plugin until a patch can be applied
• Implement WAF rules to block unauthenticated POST requests to the plugin's import endpoints
• Restrict access to WordPress admin areas and REST API endpoints via IP allowlisting if possible
• Enable WordPress two-factor authentication for all administrator accounts as a defense-in-depth measure

# Disable the vulnerable plugin via WP-CLI until patched
wp plugin deactivate import-export-with-custom-rest-api

# List all administrators to audit for unauthorized accounts
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# Delete any unauthorized administrator accounts (replace USER_ID)
wp user delete USER_ID --reassign=1