Exploitation Research Plan - CVE-2025-69350

1. Vulnerability Summary

The Accordions – Responsive Accordion & FAQ Plugin (versions <= 3.0.3) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin fails to sanitize accordion item content when saving it to the database and subsequently fails to escape this content when rendering it via a shortcode. While WordPress core typically prevents Editors from injecting scripts if the unfiltered_html capability is removed (e.g., in Multisite or via configuration), this plugin bypasses those protections by manually handling post meta without applying wp_kses_post() or similar sanitization.

2. Attack Vector Analysis

• Endpoint: WordPress Admin Post Editor (/wp-admin/post.php or /wp-admin/post-new.php)
• Post Type: accordions
• Vulnerable Parameter: accordions_metabox_data[section][INDEX][content] (inferred)
• Authentication Level: Authenticated (Editor+)
• Preconditions:
  • The site is a Multi-site installation OR define( 'DISALLOW_UNFILTERED_HTML', true ); is set in wp-config.php.
  • The Editor user must be able to create/edit accordions post types (standard plugin behavior).

3. Code Flow (Inferred)

1. Entry Point (Save): An Editor saves an accordion. The plugin hooks into save_post (specifically for the accordions post type).
2. Processing: The function (likely accordions_save_metabox_data) retrieves the array $_POST['accordions_metabox_data'].
3. Storage: The plugin calls update_post_meta( $post_id, 'accordions_metabox_data', $data ) without passing the content through wp_kses_post().
4. Entry Point (Render): A user visits a page containing the shortcode [accordions id="XYZ"].
5. Processing: The shortcode handler (likely accordions_shortcode_callback) retrieves the meta using get_post_meta().
6. Sink: The plugin iterates through the accordion sections and outputs the content directly: echo $section['content'] (or equivalent), failing to use esc_html() or wp_kses_post().

4. Nonce Acquisition Strategy

Since the exploit requires Editor-level access to the Admin Dashboard, nonces must be retrieved from the page context.

1. Identify the Page: The vulnerability is triggered during the creation or editing of an "Accordion" post.
2. Navigate: Use browser_navigate to go to /wp-admin/post-new.php?post_type=accordions.
3. Extract Nonce: The standard WordPress post nonce is located in the #_wpnonce hidden input field.
   • Action String: add-accordions (for new posts) or update-post_[ID] (for existing).
   • JS Extraction: browser_eval("document.querySelector('#_wpnonce').value")
4. Note: If the plugin uses a custom AJAX save button, the nonce might be localized in a script object (e.g., accordions_ajax?.nonce). Check for accordions_metabox_data related scripts in the source.

5. Exploitation Strategy

Step 1: Setup Environment

• Create an Editor user.
• Enforce DISALLOW_UNFILTERED_HTML to simulate a secured/Multisite environment where the Editor's unfiltered_html capability is stripped.

Step 2: Inject Payload

1. Login as the Editor.
2. Navigate to the Accordion creation page.
3. Capture the necessary form fields, specifically the post_ID (if auto-drafted) and the _wpnonce.
4. Submit a POST request to /wp-admin/post.php with the following parameters:
   • action: editpost
   • post_type: accordions
   • post_ID: [ID]
   • _wpnonce: [EXTRACTED_NONCE]
   • accordions_metabox_data[section][0][header]: Test Header
   • accordions_metabox_data[section][0][content]: <script>alert(document.domain)</script>
   • post_title: XSS Accordion
   • publish: Publish

Step 3: Trigger Execution

1. Create a new public post or page.
2. Insert the shortcode: [accordions id="[POST_ID]"].
3. Navigate to the public page as any user (e.g., Administrator).
4. Observe the JavaScript execution.

6. Test Data Setup

1. User: wp user create editor_user editor@example.com --role=editor --user_pass=password123
2. Security Config: Add define( 'DISALLOW_UNFILTERED_HTML', true ); to wp-config.php.
3. Shortcode Page: wp post create --post_type=page --post_title="Accordion Test" --post_content='[accordions id="REPLACE_WITH_ID"]' --post_status=publish

7. Expected Results

• The POST request to save the accordion should return a 302 redirect back to the editor, indicating success.
• When viewing the public page, a browser alert should appear displaying the domain name.
• The HTML source of the rendered accordion should contain the literal <script> tag instead of escaped entities.

8. Verification Steps

1. Database Check: Use WP-CLI to verify the unsanitized content is stored:
   wp post meta get [POST_ID] accordions_metabox_data
   Confirm the output contains the raw <script> tag.
2. Capability Check: Confirm the Editor user does not have unfiltered_html:
   wp user cap list editor_user | grep unfiltered_html (Should return nothing).

9. Alternative Approaches

• Nested Payloads: If content is partially sanitized, attempt to inject into the header field (e.g., accordions_metabox_data[section][0][header]).
• JSON Meta: If the plugin stores data as a JSON string in post meta, ensure the payload is correctly escaped for the POST request but remains active in the final HTML.
• SVG Payload: If <script> is blocked by a WAF, use <img src=x onerror=alert(1)> or a malicious SVG within the accordion content.