Exploitation Research Plan - CVE-2026-57355

1. Vulnerability Summary

The Classified Listing – AI-Powered Classified ads & Business Directory plugin (up to 5.4.2) is vulnerable to Missing Authorization in its administrative notice handling logic. Specifically, the Rtcl\Controllers\Admin\NoticeController class hooks the update_rating_status function to admin_init. Because admin_init fires for every user accessing the WordPress dashboard (including low-privileged Subscribers), and because this function likely lacks a current_user_can('manage_options') check, authenticated attackers can perform unauthorized actions such as dismissing site-wide plugin notices or modifying plugin-wide "rating" metadata.

2. Attack Vector Analysis

• Endpoint: /wp-admin/index.php (or any admin-area URL that triggers admin_init).
• HTTP Method: GET
• Action Hook: admin_init calls Rtcl\Controllers\Admin\NoticeController::update_rating_status.
• Payload Parameters:
  • rtcl_skip: Set to 1 to trigger notice dismissal.
  • rtcl_reminder: Set to 1 to delay the notice.
  • rtcl_rated: Set to 1 to mark the plugin as rated.
  • _wpnonce: A required nonce with the action string rtcl_notice_nonce.
• Authentication: Required (Subscriber or higher).
• Preconditions: The "Enjoying Classified Listing?" rating notice must be active or eligible to be displayed (triggered by the plugin being active for a certain duration).

3. Code Flow

1. Entry Point: A Subscriber logs into the WordPress dashboard (/wp-admin/).
2. Hook Execution: wp-admin/admin.php (and others) trigger admin_init.
3. Vulnerable Handler: Rtcl\Controllers\Admin\NoticeController::__construct registers update_rating_status to admin_init.
4. Missing Check: update_rating_status (inferred) processes $_GET['rtcl_skip'] and verifies the nonce $_GET['_wpnonce'] using the action rtcl_notice_nonce.
5. Unauthorized Action: If the nonce is valid, the function proceeds to update_option() to dismiss the notice for the entire site, despite the user only having Subscriber permissions.

4. Nonce Acquisition Strategy

The nonce rtcl_notice_nonce is generated within the display_admin_notice() method of NoticeController.php. This notice is hooked to admin_notices, which is visible to Subscribers on their dashboard.

Steps to obtain the nonce:

1. Log in as a Subscriber.
2. Navigate to /wp-admin/index.php.
3. Locate the rating notice in the HTML (class .rtcl-review-notice).
4. Extract the _wpnonce value from the "No Thanks" or "Already Rated!" links.

Automated Extraction (browser_eval):

// Locate the 'No Thanks' link which contains the dismissal parameters and nonce
const dismissalLink = document.querySelector('.rtcl-review-notice a[href*="rtcl_skip=1"]')?.href;
if (dismissalLink) {
    const urlParams = new URLSearchParams(new URL(dismissalLink).search);
    console.log(urlParams.get('_wpnonce'));
}

5. Exploitation Strategy

Step 1: Triggering the Site-Wide Dismissal

Once the nonce is acquired, the Subscriber sends a request to trigger the dismissal for all users.

• Tool: http_request
• Method: GET
• URL: http://vulnerable-site.com/wp-admin/index.php?rtcl_skip=1&_wpnonce=[EXTRACTED_NONCE]
• Headers:
  • Cookie: [Subscriber Session Cookies]

Step 2: Verification

As an Administrator, navigate to the dashboard. The rating notice, which should have been visible, will now be gone site-wide because the plugin option (e.g., rtcl_rating_notice_dismissed) has been updated.

6. Test Data Setup