CVE-2025-67586

MEDIUM

WordPress Highlight and Share plugin <= 5.2.0 - Broken Access Control vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-67586 has a selected CVSS score of 4.7 (medium); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

Missing Authorization vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Highlight and Share: from n/a through <= 5.2.0.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 9, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Highlight and Share

Browse Ronald Huereca / Highlight and Share

Default status: unaffected

CVE ListThrough 5.2.0affected

Proofs of concept

2

Catalogued exploits

ExploitDBWordPress Plugin 5.2.0 - Broken Access ControlExploitDB exploitby cydev.turingWriteup1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing a broken access control vulnerability in the WordPress Highlight and Share plugin <= 5.2.0. It explains the vulnerability, required privileges, and provides a manual proof-of-concept using captured nonce and curl commands, but does not contain executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied text is a plaintext description of a broken access control vulnerability and a curl-based proof-of-concept. It contains no executable code, no obfuscation, and no instructions for the reviewer to perform any action beyond sending a crafted HTTP request to a target WordPress site. The PoC demonstrates the claimed vulnerability without any concealed or deceptive behavior.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesEnglish
Target softwareWordPress Highlight and Share plugin
Attack typesBroken Access ControlUnauthorized Email Sending
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a textual description of a vulnerability and a manual proof-of-concept using curl commands. It does not contain any executable code, automated exploitation script, or scanning logic. The file is a writeup, not an exploit or scanner.

exploits/multiple/webapps/52511.go:1-64

Requirements

  • Target website must have vulnerable Highlight and Share plugin (<= 5.2.0) installed.exploits/multiple/webapps/52511.go:1
  • Attacker must obtain a valid nonce by capturing a legitimate 'Share via Email' request from a public post.exploits/multiple/webapps/52511.go:26-34

Observed behavior

  • The writeup describes sending an unauthenticated POST request to wp-admin/admin-ajax.php with action 'has_email_form_submission' and captured nonce to trigger email sharing.exploits/multiple/webapps/52511.go:40-49
  • The expected response is a JSON object indicating successful email sharing without authentication.exploits/multiple/webapps/52511.go:52-63
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Description
Payload withheldThe PoC describes how to exploit CVE-2025-67586 by sending a crafted POST request to admin-ajax.php.exploits/multiple/webapps/52511.go:10-16
Proof Of Concept Command
Payload withheldThe PoC demonstrates the vulnerability by sending an unauthenticated email sharing request. It targets the stated vulnerable plugin and does not include any backdoor or unrelated payload.exploits/multiple/webapps/52511.go:40-49
Review boundaries

What the analysis did not establish

  • Only the supplied text file was reviewed; no external resources, binaries, or network content were fetched or analyzed.
  • The artifact is a plaintext description; no executable code was present to analyze for hidden behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubr0xtsec/CVERepository PoCby r0xtsec0Exploit2 files

3.0 KiB · linked to 3 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README writeup for CVE-2025-67586 that includes a step-by-step procedure and a curl command to exploit a broken access control vulnerability in the WordPress Highlight and Share plugin, allowing unauthenticated email sending.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a single README.md file containing a textual writeup and a curl command demonstrating an unauthenticated AJAX exploit for CVE-2025-67586. No executable code, obfuscated payloads, or instructions to run anything other than the documented curl command are present. The described behavior targets the stated WordPress plugin vulnerability and does not exhibit concealed operator-directed harm, persistence, credential theft, or unrelated payload delivery.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesMarkdownShell
Target softwareWordPress Highlight and Share plugin
Attack typesBroken Access ControlEmail Spam
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact provides a curl command that sends a crafted POST request to the vulnerable endpoint to trigger unauthorized email sending, which constitutes exploit code. The writeup describes the vulnerability and includes executable instructions to exercise it.

README.md:5README.md:42-51

Requirements

  • A target website with the vulnerable Highlight and Share plugin (<= 5.2.0) installed.README.md:7-9
  • A valid nonce obtained from a public post's 'Share via Email' functionality.README.md:28-36

Observed behavior

  • Sends an unauthenticated POST request to wp-admin/admin-ajax.php with the action 'has_email_form_submission' and attacker-controlled parameters, including a captured nonce, to trigger email sharing.README.md:42-51
  • The expected response indicates successful email sending with attacker-supplied recipient address.README.md:54-66
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Curl Command
Payload withheldThe curl command is the only actionable content in the PoC. It sends a POST request to the target WordPress admin-ajax.php endpoint with parameters that match the described vulnerability (unauthenticated email sharing). The command does not download or execute external resources, establish reverse shells, or exfiltrate data to an attacker-controlled server beyond the documented email abuse.README.md:42-51
Review boundaries

What the analysis did not establish

  • Only one of two text files (README.md) is included; the second file is omitted, so its content is unknown.
  • The evidence packet reports complete_artifact_coverage as false, indicating the full artifact is not provided.
  • One file (1,064 bytes) was classified as unclassified and reported as metadata-only; its content was not inspected. The inventory analysis indicates no executable source or binary files were identified in the repository, but the unclassified file's content remains unknown.
  • Only the README.md file content was provided; the second text file in the repository was not included in the evidence packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3