External risk intelligence

WordPress Hybrid Composer Unauthenticated Settings Change Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2019-25738

The vulnerability affects a WordPress plugin which, by design, functions as a public-facing web application. The vulnerable endpoint, admin-ajax.php, is a standard component of WordPress sites that is typically accessible to the public internet to support site features.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in WordPress Hybrid Composer could allow unauthorized users to change critical website settings, potentially leading to account takeovers. This issue affects how the plugin handles user options and could enable an attacker to gain administrator access without needing any credentials. The main concern is confirming relevance and exposure.

Unauthenticated users can alter website settings.
Enables unauthorized administrator access.
Confirm if this plugin is used.

Attack Path

How an attacker could exploit the issue

An attacker can target a WordPress site using the Hybrid Composer plugin by sending a specially crafted request to the site's `admin-ajax.php` file. This request exploits the `hc_ajax_save_option` action to change critical WordPress settings. By enabling user registration and setting the default user role to administrator, an attacker can gain full control of the website.

No authentication required for entry.
Exploits the `hc_ajax_save_option` action.
Leads to full account takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to change WordPress settings. When supported by the advisory, an attacker could exploit this by sending a POST request to the admin-ajax.php endpoint to enable user registration and set the default user role to administrator, potentially leading to account takeover.

WordPress options could be altered.
Via unauthenticated POST requests.
Account takeover may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WordPress Hybrid Composer plugin vulnerability demands immediate attention from teams managing WordPress deployments. Since the exploit targets an unauthenticated settings change and can lead to account takeover, the first practical step is to locate all instances of the affected plugin, determine their internet accessibility and business criticality, and identify the designated owner for remediation. Subsequent actions will depend on this initial assessment and risk evaluation.

Identify plugin owners and hosts.
Verify internet exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WordPress Hybrid Composer plugin?

Hybrid Composer is a plugin framework for WordPress used to build and manage website layouts and content structures. It functions as an extension of the core WordPress platform, providing specialized tools for site customization. Because it integrates directly into the WordPress administrative environment, it handles various background tasks, including the saving of plugin-specific configurations and site options.

What is the vulnerability in CVE-2019-25738?

This vulnerability is classified as Missing Authentication for Critical Function (CWE-306). In plain terms, it means the software performs sensitive actions—in this case, updating website configuration settings—without first verifying that the user is logged in as an administrator. Because the plugin fails to check for proper credentials, it allows unauthorized users to modify internal site parameters.

How is this vulnerability triggered?

An attacker triggers this bug by sending a specifically formatted POST request to the WordPress admin-ajax.php file. The request must use the hc_ajax_save_option action to target the plugin's configuration logic. It is important to note that the vulnerability is only active when this specific plugin function is reached; normal site traffic or requests that do not target this specific AJAX action do not trigger the flaw.

Is my site at risk according to Halo Surface Signal?

Yes, if you use the affected plugin, you should consider your site at risk. Halo Surface Signal notes that this vulnerability affects a plugin designed for public-facing web applications. Since the target endpoint, admin-ajax.php, is a standard component of WordPress that remains accessible via the public internet to provide site functionality, the flaw is reachable from outside your network.

What should I do if I run this technology?

Your first step is to inventory your WordPress installations to confirm if the Hybrid Composer plugin is currently active. Once identified, evaluate the criticality of those sites and determine who manages them. Since the vulnerability allows for full account takeover by enabling unauthorized registration and changing roles, you must treat this as a high priority and coordinate with your team to review plugin status and plan for updates or removal.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.