CVE-2019-25738: WordPress Hybrid Composer Unauthenticated Admin Privilege Escalation

Technical summary

CVE-2019-25738 is an unauthenticated privilege escalation vulnerability in the Hybrid Composer plugin (v1.4.6) stemming from insufficient access control on the hc_ajax_save_option AJAX action. The vulnerability allows any remote attacker to send POST requests to wp-admin/admin-ajax.php with action=hc_ajax_save_option to arbitrarily modify WordPress options. By chaining option modifications—specifically enabling user registration (users_can_register) and setting the default role to administrator (default_role)—an attacker can register an administrator account without authentication, resulting in complete administrative compromise. The root cause is CWE-306 (Missing Authentication for Critical Function), as the plugin fails to implement capability checks or nonce verification on a critical administrative AJAX endpoint.

Business impact

Compromise of a WordPress site running Hybrid Composer 1.4.6 gives attackers full control over site content, user data, and backend systems. Malicious actors can inject malware, redirect users to phishing sites, steal customer or employee information, modify pricing or product listings in e-commerce contexts, or use the compromised server for botnet distribution. The ease of exploitation and total control granted means time-to-impact is measured in minutes, not hours.

Affected systems

WordPress installations using the Hybrid Composer plugin version 1.4.6 are directly affected. Any site running this specific version with the plugin enabled and wp-admin/admin-ajax.php accessible is vulnerable, regardless of other security configurations. WordPress multisite installations running Hybrid Composer 1.4.6 are equally at risk. The vulnerability requires no special prerequisites, authentication, or user interaction.

Exploitability

This vulnerability is trivial to exploit. An attacker requires only network access to the WordPress site and the ability to craft HTTP POST requests—no special tools or code are necessary. The attack is completely unauthenticated, requires no user interaction, and works over the network. The CVSS score of 9.8 reflects the combination of zero barriers to exploitation, complete compromise of confidentiality, integrity, and availability, and the absence of any scope limitation. No exploit code sophistication is needed; a simple curl command or HTTP POST tool is sufficient.

Remediation

Immediately update WordPress Hybrid Composer to a patched version beyond 1.4.6. Verify the update version against the official plugin repository or vendor advisory to confirm the fix for CVE-2019-25738 is included. As an interim mitigation, disable the plugin entirely until patching is possible. Additionally, audit WordPress user accounts and roles to identify any unauthorized administrator accounts that may have been created, and review WordPress option logs (if available) for unexpected modifications to user registration or default role settings.

Patch guidance

Proceed to wp-admin and navigate to Plugins > Installed Plugins. Locate WordPress Hybrid Composer and check for an available update. If an update is available, click 'Update Now.' After updating, verify the installed version is greater than 1.4.6 by checking Plugins > Installed Plugins and confirming the version number. If no update is available from the repository, contact the plugin developer for a security patch or consider switching to an actively maintained alternative if Hybrid Composer is no longer receiving updates. Always back up your WordPress database before applying plugin updates.

Detection guidance

Monitor WordPress logs and admin-ajax.php access logs for POST requests containing the parameter action=hc_ajax_save_option, particularly from unauthenticated sessions. Check WordPress user role history for unexpected administrator account creations, especially accounts created automatically without corresponding login records. Examine WordPress options table (wp_options) for unexpected changes to users_can_register and default_role. Query server access logs for admin-ajax.php POST requests from external IP addresses that do not correspond to known administrative users. Consider deploying a Web Application Firewall (WAF) rule to block admin-ajax.php requests with unrecognized or suspicious action parameters from unauthenticated sources.

Why prioritize this

This vulnerability demands immediate remediation. The CVSS 9.8 CRITICAL score reflects perfect attack conditions: zero authentication required, zero user interaction needed, complete confidentiality/integrity/availability impact, and network-based attack vector. The exploitation pathway is trivial and requires no specialized tools. Any attacker scanning the internet for WordPress sites running this plugin version can compromise the site in seconds. Organizations running Hybrid Composer 1.4.6 should treat this as a P0/P1 incident requiring emergency patching within hours, not days.

Risk score, explained

The CVSS 3.1 score of 9.8 (CRITICAL) is derived from: Attack Vector=Network (AV:N), Attack Complexity=Low (AC:L), Privileges Required=None (PR:N), User Interaction=None (UI:N), Scope=Unchanged (S:U), Confidentiality=High (C:H), Integrity=High (I:H), Availability=High (A:H). Every attack vector and impact metric is at maximum severity. There are no exploitability barriers—no authentication, no user interaction, no complex setup required. The attacker gains unrestricted administrative access, enabling complete site control and data exfiltration.

Frequently asked questions