CVE-2025-13307: 
WordPress vulnerability analysis and mitigation

CVE-2025-13307 is a Remote Code Execution (RCE) vulnerability in the Ocean Modal Window WordPress plugin affecting all versions before 2.3.3. The flaw allows authenticated users with Editor or Administrator privileges (edit_pages capability) to inject arbitrary PHP code via modal display conditions, which are subsequently executed server-side via an eval() statement on every page load. It was publicly disclosed on November 28, 2025, by researcher Alex Tselevich (nos3curity) and assigned a CVSS v3.1 base score of 7.2 (High) (WPScan, Feedly).

The root cause is improper control of code generation (CWE-94), where user-supplied input stored in the mw_display_on and mw_hide_on post meta fields is passed unsanitized into a PHP eval() statement that executes on every page of the site. An attacker with Editor-level access can craft a POST request to the WordPress REST API endpoint /wp-json/wp/v2/ocean_modal_window/[ID], injecting a malicious payload such as "meta":{"mw_display_on":["system('sleep 5')"]} into the modal's metadata. Because the conditions are evaluated globally on every page render, the injected code executes in the context of the web server process without any further user interaction after publication (WPScan).

Successful exploitation grants the attacker arbitrary PHP code execution on the web server, resulting in full compromise of confidentiality, integrity, and availability of the affected WordPress installation. An attacker can read sensitive files (e.g., wp-config.php containing database credentials), modify site content, deploy web shells for persistent access, or pivot to other systems accessible from the server. Because the injected code runs on every page load for all site visitors, the impact extends beyond the administrative context to the entire site's runtime environment (WPScan, Feedly).

A verified proof-of-concept (PoC) is publicly available via WPScan, demonstrating exploitation using Burp Suite to intercept and modify the REST API publish request. Exploitation requires authentication as an Editor or Administrator, limiting opportunistic mass exploitation but making it a significant insider threat or post-compromise escalation vector. No in-the-wild exploitation or threat actor attribution has been reported as of the available data. The EPSS score is approximately 0.305%, and the vulnerability does not appear in the CISA KEV catalog (WPScan, Feedly).

1. Reconnaissance: Identify WordPress sites using the Ocean Modal Window plugin (versions < 2.3.3) with the OceanWP theme, using tools like WPScan or manual inspection of plugin directories.
2. Obtain Editor/Admin credentials: Acquire valid credentials for an account with edit_pages capability (Editor or Administrator role) via phishing, credential stuffing, or other means.
3. Create a modal post: Log in to the WordPress admin dashboard, navigate to the Modal tab, and create a new modal item with any title and content, then click Publish while intercepting traffic with Burp Suite.
4. Intercept and modify the REST API request: Capture the POST request to /wp-json/wp/v2/ocean_modal_window/[SOME_ID] and inject a malicious PHP payload into the mw_display_on meta field:

   {"id":745,"title":"test","meta":{"mw_display_on":["system('id')"]},"content":"\ntest\n","status":"publish"}

5. Forward the request: Allow the modified request to reach the server, publishing the modal with the injected payload.
6. Trigger execution: Visit any page on the site; the eval() statement processes the mw_display_on condition on every page load, executing the injected system command in the web server's process context.
7. Escalate: Replace the PoC payload with a reverse shell or web shell deployment command to establish persistent access (WPScan).

• Network: Unusual POST requests to /wp-json/wp/v2/ocean_modal_window/ containing JSON bodies with PHP function calls (e.g., system, exec, passthru, shell_exec) in the meta field; unexpected outbound connections from the web server process to external IPs.
• Logs: WordPress REST API access logs showing POST requests to the ocean_modal_window endpoint with anomalous meta payloads; PHP error logs containing eval() execution traces or warnings related to modal condition processing.
• File System: Newly created PHP web shell files in the WordPress uploads directory or plugin directories; unexpected modifications to wp-config.php or .htaccess.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., sh, bash, curl, wget, python) following page requests; unexpected cron jobs added under the web server user account (WPScan).

Update the Ocean Modal Window plugin to version 2.3.3 or later, which resolves the unsafe eval() usage in modal condition processing. No official configuration-based workaround has been published; if immediate patching is not possible, consider disabling the plugin or restricting Editor-level access to modal creation. Site administrators should also audit existing modal posts for suspicious mw_display_on or mw_hide_on meta values as part of incident response (WPScan).

The vulnerability was discovered and responsibly disclosed by researcher Alex Tselevich (nos3curity) of nosecurity.blog, who submitted it to WPScan where it was verified. The disclosure was noted in Wordfence's weekly WordPress vulnerability report and picked up by several vulnerability aggregators including CIRCL, VulDB, and CVEFeed. No major vendor statements beyond the plugin fix or significant broader media coverage have been identified (WPScan).