Exploitation Research Plan: CVE-2026-61952 - WP Sheet Editor Missing Authorization

1. Vulnerability Summary

The Bulk Edit Products for WooCommerce – WP Sheet Editor plugin (versions <= 1.8.21) contains a missing authorization vulnerability in its AJAX handlers. Specifically, functions related to column visibility management (e.g., remove_column, update_columns_settings) lack sufficient capability checks. While restore_columns includes a check for manage_options, other adjacent functions in WP_Sheet_Editor_Columns_Visibility only verify the nonce but fail to restrict the action to administrators. This allows authenticated users with Author-level access to modify global plugin settings, such as hiding columns for all users or altering spreadsheet visibility configurations.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: vgse_remove_column (and potentially vgse_update_columns_visibility)
• Required Authentication: Authenticated, Author-level access (PR:L). Authors generally have access to the WooCommerce Product spreadsheet if they have the edit_products capability.
• Payload Parameters:
  • action: vgse_remove_column
  • post_type: The post type slug (e.g., product)
  • column: The internal key of the column to remove (e.g., _regular_price, _sku)
  • nonce: A valid security nonce extracted from the editor page.

3. Code Flow

1. Registration: In modules/columns-visibility/columns-visibility.php, the init() method registers several AJAX actions:

   add_action( 'wp_ajax_vgse_remove_column', array( $this, 'remove_column' ) );
   add_action( 'wp_ajax_vgse_update_columns_visibility', array( $this, 'update_columns_settings' ) );
   

2. Missing Check: In version 1.8.21, the remove_column() function (and update_columns_settings) likely performs a nonce check using VGSE()->helpers->verify_nonce_from_request() but lacks the secondary capability check seen in restore_columns():

   // Contrast with restore_columns() which HAS the check:
   if ( ! VGSE()->helpers->verify_nonce_from_request() || ! VGSE()->helpers->user_can_manage_options() ) {
       wp_send_json_error(...);
   }
   

3. Sink: The function calls save_removed_columns($columns, $post_type), which executes update_option( $this->removed_columns_key, $removed_columns, false ). This updates the site-wide vgse_removed_columns option, affecting all users' view of the spreadsheet.

4. Nonce Acquisition Strategy

The nonce is localized for the spreadsheet editor. Since the vulnerability requires Author-level access, we must obtain the nonce from the editor interface.

1. Identify Editor Page: The Product Editor page is typically located at /wp-admin/admin.php?page=vgse-view-product.
2. Access Page: Use the browser_navigate tool to go to this URL as an Author.
3. Extract Nonce: The plugin localizes settings in the vgse_editor_settings object.
   • JS Variable: window.vgse_editor_settings
   • Nonce Key: nonce
4. Execution: Use browser_eval("window.vgse_editor_settings?.nonce") to retrieve the token.

5. Exploitation Strategy

Step-by-Step Plan

1. Preparation: Ensure the environment has WooCommerce and the WP Sheet Editor plugin active. Create an Author user.
2. Nonce Retrieval:
   • Log in as the Author.
   • Navigate to the Product Sheet: /wp-admin/admin.php?page=vgse-view-product.
   • Extract the nonce using browser_eval.
3. Malicious Request:
   • Use the http_request tool to send a POST request to admin-ajax.php.
   • Target: Remove the "Regular Price" column (_regular_price) to disrupt store management.
4. HTTP Request Details:
   • URL: http://localhost:8080/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=vgse_remove_column&post_type=product&column=_regular_price&nonce=[EXTRACTED_NONCE]
     

6. Test Data Setup

1. Install: WooCommerce and "Bulk Edit Products for WooCommerce – WP Sheet Editor".
2. Content: Add at least one test product so the spreadsheet loads data.
3. User: Create a user with the author role. Ensure they have the edit_products capability (default for WooCommerce Authors).

7. Expected Results

• Response: The AJAX request should return a JSON success message (e.g., {"success":true,"data":{...}}).
• Impact: The "Regular Price" column will disappear from the spreadsheet for all users, including administrators.
• Database: The WordPress option vgse_removed_columns will now contain _regular_price for the product entry.

8. Verification Steps

After the exploit, use WP-CLI to verify the state of the system:

1. Check Options:

   wp option get vgse_removed_columns --format=json
   

2. Verify Content: Ensure the output JSON includes "_regular_price" under the product key.
3. UI Verification: Navigate to the editor as an Administrator and confirm the "Regular Price" column is missing from the table.

9. Alternative Approaches

If vgse_remove_column is patched or behaves differently, attempt to exploit vgse_update_columns_visibility:

• Action: vgse_update_columns_visibility
• Body: action=vgse_update_columns_visibility&post_type=product&columns[0][key]=_regular_price&columns[0][status]=disabled&nonce=[NONCE]
• This endpoint targets the visibility status settings stored in vgse_columns_visibility.