Admin and Site Enhancements (ASE) <= 7.6.2.1 - Authenticated (Subscriber+) Privilege Escalation

Vulnerability Summary

The Admin and Site Enhancements (ASE) plugin for WordPress is vulnerable to Authenticated Privilege Escalation in versions up to and including 7.6.2.1. The vulnerability exists because the plugin's settings update mechanism, specifically handled via AJAX actions, fails to perform adequate capability checks (e.g., current_user_can('manage_options')). This allows a user with Subscriber-level permissions to modify the plugin's global configuration.

By manipulating the admin_site_enhancements option, an attacker can enable modules that grant higher privileges or allow for code execution. A direct path to privilege escalation involves enabling the "Custom Code" module (which allows injecting arbitrary scripts into the admin dashboard) or enabling the "SVG Upload" module for low-privileged roles, which can be leveraged to gain Remote Code Execution (RCE) or perform XSS to hijack administrator sessions.

Attack Vector Analysis

• Vulnerable Endpoint: /wp-admin/admin-ajax.php
• Action: asenha_save_settings (or asenha_update_settings, inferred from plugin structure and common patterns in such vulnerabilities).
• HTTP Parameter: settings (containing a serialized or array-formatted configuration for the plugin).
• Authentication Level: Subscriber+ (any logged-in user).
• Preconditions: The plugin must be active. No specific module needs to be enabled initially, as the attacker will enable them.

Code Flow