Claspo – Popups, Spin the Wheel & Email Capture <= 1.0.7 - Missing Authorization

This research plan focuses on identifying and exploiting the Missing Authorization vulnerability in the Claspo plugin (CVE-2025-68568). Since source files are not provided, the plan relies on typical WordPress plugin patterns for SaaS integrations and flags inferred identifiers for verification.

---

1. Vulnerability Summary

The Claspo plugin (<= 1.0.7) registers one or more AJAX or REST API handlers intended for administrative configuration (such as connecting a Claspo account or updating settings). However, these handlers are either hooked to wp_ajax_nopriv_* (accessible to unauthenticated users) or registered as REST routes without a permission_callback. Critically, the callback functions lack a current_user_can() check, allowing any visitor to modify plugin settings.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php (Most likely for this plugin type).
• Action: Likely claspo_save_settings, claspo_update_config, or claspo_set_account_id (inferred).
• Parameter: A setting key (e.g., account_id, api_key, script_id) and its value.
• Authentication: None (Unauthenticated).
• Precondition: The plugin must be active. If the endpoint requires a nonce, the researcher must identify a page where the nonce is exposed.

3. Code Flow (Inferred)

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with an action parameter registered via add_action('wp_ajax_nopriv_[ACTION_NAME]', ...).
2. Hook Registration: The plugin likely registers the hook in the main plugin file or an admin/ajax controller (e.g., includes/class-claspo-ajax.php).
3. Vulnerable Callback: The callback function (e.g., save_account_data) retrieves data from $_POST.
4. Missing Check: The function performs the action (e.g., update_option('claspo_account_id', $_POST['id'])) without verifying current_user_can('manage_options').
5. Sink: update_option() or wpdb::query() updates the site configuration.

4. Nonce Acquisition Strategy

If the handler uses check_ajax_referer or wp_verify_nonce, the nonce must be retrieved from the frontend.

1. Identify JS Localization: Search the codebase for wp_localize_script.
   • grep -r "wp_localize_script" .
2. Identify the Object and Key: Look for the variable name (e.g., claspo_obj) and the nonce key (e.g., ajax_nonce).
3. Trigger Script Loading: Determine if the script only loads on pages with the Claspo popup.
   • If a shortcode is required, create a page: wp post create --post_type=page --post_status=publish --post_content='[claspo]' (inferred shortcode).
4. Extraction:
   • Navigate to the page: browser_navigate("http://localhost:8080/test-page")
   • Extract: browser_eval("window.claspo_obj?.ajax_nonce") (Replace claspo_obj and ajax_nonce with actual names found in Step 1).

5. Exploitation Strategy

Step 1: Discovery

Find the vulnerable hook and the configuration parameter it modifies.

# Find nopriv AJAX hooks
grep -rn "wp_ajax_nopriv_" .

# Examine the callback function for the first match
# Example: If 'wp_ajax_nopriv_claspo_save' is found, check its callback

Step 2: Identify the Payload

Look for update_option or update_user_meta inside the callback to see what parameters are accepted.

• Expected parameters: action, nonce (if applicable), and the setting (e.g., claspo_id).

Step 3: Execute Unauthorized Modification

Using the http_request tool, attempt to change the Claspo Account ID to an arbitrary value (e.g., 13371337).

Request Template:

• Method: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: action=[INFERRED_ACTION]&[SETTING_PARAM]=13371337&nonce=[EXTRACTED_NONCE]

6. Test Data Setup

1. Install & Activate: Ensure Claspo <= 1.0.7 is active.
2. Initial State: Check the current account ID (if any) via WP-CLI:
   • wp option get claspo_account_id (inferred option name).
3. Public Page: Create a page that might expose a nonce if the plugin enqueues scripts on the frontend.

7. Expected Results

• Response: The server returns a 200 OK (often with 1 or a JSON success message).
• Effect: The plugin setting is updated in the database without any administrator interaction.
• Security Impact: An attacker can replace the legitimate Claspo script with their own, enabling XSS (via the Claspo popup service) on the entire site.

8. Verification Steps

After the exploit attempt, verify the change using WP-CLI:

# Check the option value
wp option get claspo_account_id 

# If the result is '13371337', the exploit was successful.

9. Alternative Approaches

• REST API: If no AJAX nopriv hooks are found, search for register_rest_route.
  • grep -rn "register_rest_route" .
  • Check for routes missing the permission_callback or using __return_true.
  • Target the POST/PUT method for those routes.
• Admin Init: Check if a function is hooked to admin_init. Note that admin_init runs for admin-ajax.php even for unauthenticated users. If the function processes $_POST and doesn't check capabilities, it is vulnerable.
  • grep -rn "add_action.*admin_init" .