CVE-2025-67985

MEDIUM

WordPress Document Library Lite plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-67985 has a selected CVSS score of 5.3 (medium); EIP currently links 1 repository PoC.

Description

Authorization Bypass Through User-Controlled Key vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Document Library Lite: from n/a through <= 1.1.7.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 18, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Document Library Lite

Browse Barn2 Plugins / Document Library Lite

Default status: unaffected

CVE ListThrough 1.1.7affected

Proofs of concept

1

Repository PoCs

GitHubr0xtsec/CVERepository PoCby r0xtsec0Exploit2 files

3.0 KiB · linked to 3 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README writeup for CVE-2025-67586 that includes a step-by-step procedure and a curl command to exploit a broken access control vulnerability in the WordPress Highlight and Share plugin, allowing unauthenticated email sending.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a single README.md file containing a textual writeup and a curl command demonstrating an unauthenticated AJAX exploit for CVE-2025-67586. No executable code, obfuscated payloads, or instructions to run anything other than the documented curl command are present. The described behavior targets the stated WordPress plugin vulnerability and does not exhibit concealed operator-directed harm, persistence, credential theft, or unrelated payload delivery.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesMarkdownShell
Target softwareWordPress Highlight and Share plugin
Attack typesBroken Access ControlEmail Spam
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact provides a curl command that sends a crafted POST request to the vulnerable endpoint to trigger unauthorized email sending, which constitutes exploit code. The writeup describes the vulnerability and includes executable instructions to exercise it.

README.md:5README.md:42-51

Requirements

  • A target website with the vulnerable Highlight and Share plugin (<= 5.2.0) installed.README.md:7-9
  • A valid nonce obtained from a public post's 'Share via Email' functionality.README.md:28-36

Observed behavior

  • Sends an unauthenticated POST request to wp-admin/admin-ajax.php with the action 'has_email_form_submission' and attacker-controlled parameters, including a captured nonce, to trigger email sharing.README.md:42-51
  • The expected response indicates successful email sending with attacker-supplied recipient address.README.md:54-66
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Curl Command
curl -s -i -X POST 'http://localhost/wp-admin/admin-ajax.php' -d 'action=has_email_form_submission' -d 'formData[postId]=<POSTID>' -d 'formData[permalink]=http://localhost/?p=<POSTID>' -d 'formData[nonce]=<NONCE>' -d 'formData[toEmail]=attacker@example.com' -d 'formData[subject]=PoC' -d 'formData[shareText]=POC test' -d 'formData[emailShareType]=selection' --compressedThe curl command is the only actionable content in the PoC. It sends a POST request to the target WordPress admin-ajax.php endpoint with parameters that match the described vulnerability (unauthenticated email sharing). The command does not download or execute external resources, establish reverse shells, or exfiltrate data to an attacker-controlled server beyond the documented email abuse.README.md:42-51
Review boundaries

What the analysis did not establish

  • Only one of two text files (README.md) is included; the second file is omitted, so its content is unknown.
  • The evidence packet reports complete_artifact_coverage as false, indicating the full artifact is not provided.
  • One file (1,064 bytes) was classified as unclassified and reported as metadata-only; its content was not inspected. The inventory analysis indicates no executable source or binary files were identified in the repository, but the unclassified file's content remains unknown.
  • Only the README.md file content was provided; the second text file in the repository was not included in the evidence packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3