Exploitation Research Plan: CVE-2025-13750

1. Vulnerability Summary

The Converter for Media plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via missing authorization on its REST API endpoint /webp-converter/v1/regenerate-attachment. While the endpoint is intended for administrative use to refresh optimized image versions, it fails to implement a proper capability check (e.g., current_user_can('manage_options')). This allow any authenticated user, including those with Subscriber roles, to trigger the deletion of optimized WebP or AVIF variants for arbitrary media attachments by providing their ID.

2. Attack Vector Analysis

• Endpoint: /wp-json/webp-converter/v1/regenerate-attachment
• Method: POST (Inferred based on standard WordPress REST API patterns for actions that modify data).
• Authentication Required: Subscriber level (PR:L).
• Vulnerable Parameter: id (The ID of the attachment to target).
• Payload Type: JSON or URL-encoded.
• Preconditions:
  • The plugin must be active and have processed at least one image (generating optimized WebP/AVIF files).
  • The attacker must know or brute-force an existing attachment ID.

3. Code Flow (Inferred)

1. Route Registration: The plugin registers the REST route during rest_api_init.
   • Likely file: src/Rest/RegenerateAttachmentEndpoint.php or similar class in the src/Rest directory.
   • Vulnerable code: register_rest_route likely uses 'permission_callback' => '__return_true' or is_user_logged_in instead of checking for administrative capabilities.
2. Request Handling: The controller function (e.g., handle_request) extracts the id parameter from the WP_REST_Request.
3. Data Modification: The plugin calls an internal method (likely in an image processor class) that identifies the optimized file paths for the given id and deletes them from the filesystem (e.g., in wp-content/uploads-webpc/).

4. Nonce Acquisition Strategy

The WordPress REST API requires a wp_rest nonce for all non-GET requests performed by authenticated users to prevent CSRF.

1. Access Point: A Subscriber user can access the standard WordPress profile page (/wp-admin/profile.php).
2. Extraction: WordPress core automatically localizes the REST nonce for logged-in users in the wpApiSettings object.
3. Command: Use the browser_eval tool after navigating to any admin page:
   • browser_eval("window.wpApiSettings?.nonce")
4. Action String: The action string for this nonce is always wp_rest.

5. Exploitation Strategy

1. Authentication: Authenticate as a Subscriber user using the browser_navigate and browser_type tools.
2. Nonce Retrieval: Use browser_eval to extract the wp_rest nonce as described above.
3. Target Identification: Identify a target attachment ID (e.g., ID 1).
4. Trigger Deletion: Send an authorized POST request to the REST endpoint using the http_request tool.

Example Request:

POST /wp-json/webp-converter/v1/regenerate-attachment HTTP/1.1
Host: localhost:8080
Content-Type: application/json
X-WP-Nonce: [EXTRACTED_NONCE]

{
  "id": 1
}

6. Test Data Setup

1. Install Plugin: Install and activate webp-converter-for-media version 6.3.2.
2. Configure Plugin: Ensure the plugin is configured to optimize images (Settings > Converter for Media).
3. Upload Image: Upload a sample image (e.g., test.jpg) to the Media Library. Note its ID (usually 1 if it's the first upload).
4. Optimize: Ensure the plugin has generated a WebP version of the image. Verify the existence of the file in /var/www/html/wp-content/uploads-webpc/uploads/.../test.jpg.webp.
5. Create User: Create a user with the Subscriber role.
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password123

7. Expected Results

• HTTP Response: The server should return a 200 OK or 201 Created status code, potentially with a JSON response confirming the action.
• Filesystem Impact: The optimized WebP or AVIF file associated with the attachment ID in the uploads-webpc directory will be deleted.

8. Verification Steps

1. Check Filesystem: Use ls or a similar check to see if the optimized file still exists.
   • wp eval "echo file_exists(ABSPATH . 'wp-content/uploads-webpc/...') ? 'Exists' : 'Deleted';"
2. Check Plugin Metadata: Check if the plugin's metadata for that attachment has been updated or removed.
   • wp post list --post_type=attachment --p=1
3. Verify Non-Admin Status: Confirm the exploit was performed with the Subscriber session and not a higher privilege account.

9. Alternative Approaches

• URL-Encoded Body: If the JSON payload is rejected, try Content-Type: application/x-www-form-urlencoded with id=1 in the body.
• Query Parameters: Try passing the ID as a query parameter: /wp-json/webp-converter/v1/regenerate-attachment?id=1.
• Different Methods: If POST is not accepted, test DELETE or PUT.
• ID Discovery: If attachment IDs are unknown, use the wp-json/wp/v2/media endpoint (if public) to list available IDs.