Cryptocurrency Donation Box – Bitcoin & Crypto Donations <= 2.2.13 - Missing Authorization

This research plan outlines the steps required to analyze and exploit CVE-2026-39691, a missing authorization vulnerability in the "Cryptocurrency Donation Box" plugin.

1. Vulnerability Summary

The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin (up to 2.2.13) registers AJAX handlers that perform sensitive actions (likely updating wallet addresses or plugin settings) without properly checking the user's capabilities. Specifically, if a function is hooked to wp_ajax_nopriv_, it is accessible to unauthenticated users. If it is only hooked to wp_ajax_ but lacks a current_user_can() check, it is accessible to any logged-in user (subscriber-level). The description "unauthenticated attackers" strongly suggests the existence of a wp_ajax_nopriv_ hook or a failure in the initial check that allows the request to proceed.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: cb_save_settings or cryptobox_ajax_update (inferred based on plugin naming conventions)
• Vulnerable Parameter: $_POST data containing wallet addresses (e.g., btc_address, eth_address) or general plugin settings.
• Authentication: Unauthenticated (via wp_ajax_nopriv_) or low-privileged users.
• Preconditions: A valid WordPress nonce for the specific AJAX action may be required, although the core issue is the lack of authorization (capability check) after the nonce is verified.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an AJAX handler during init or admin_init:
   add_action( 'wp_ajax_nopriv_cb_save_settings', 'cb_save_settings_callback' ); (inferred)
2. Handler: The function cb_save_settings_callback() is called.
3. Missing Check: The function likely calls check_ajax_referer() (nonce check) but fails to call current_user_can( 'manage_options' ).
4. Sink: The function processes $_POST data and updates WordPress options using update_option() or update_post_meta().

4. Nonce Acquisition Strategy

If the plugin enforces a nonce, it is typically exposed on the frontend where the donation box is displayed.

1. Identify Shortcode: The plugin uses the shortcode [cryptocurrency_donation_box] (inferred) to display the box.
2. Create Test Page:
   wp post create --post_type=page --post_status=publish --post_title="Donation" --post_content='[cryptocurrency_donation_box]'
3. Identify Localization Key: Search the codebase for wp_localize_script. The variable name is likely cb_ajax_obj or cryptobox_vars.
4. Extract via Browser:
   Navigate to the newly created page and execute:
   browser_eval("window.cb_ajax_obj?.nonce") (inferred) or check the HTML source for a hidden input field id="cb_nonce".

5. Exploitation Strategy

This plan assumes the attacker aims to hijack donations by replacing the legitimate BTC address with an attacker-controlled one.

Step 1: Discover Action and Nonce Key
Search the plugin directory for the AJAX registration:
grep -rn "wp_ajax_nopriv" .
Find the associated function and identify the nonce action string used in check_ajax_referer('action_string', 'param_name').

Step 2: Prepare Payload

• URL: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:
  action=cb_save_settings&cb_nonce=NONCE_VALUE&btc_address=1AttackerAddressHere&eth_address=0xAttackerAddressHere (parameters inferred)

Step 3: Execute Request
Use the http_request tool to send the POST payload.

6. Test Data Setup

1. Install Plugin: Ensure cryptocurrency-donation-box version 2.2.13 is installed.
2. Initial Configuration: Configure a legitimate BTC address in the plugin settings via the admin UI.
3. Public Page: Create a page with the shortcode [cryptocurrency_donation_box] to ensure scripts and nonces are generated.

7. Expected Results

• Response: The server returns a 200 OK or a JSON success message (e.g., {"success":true}).
• Outcome: The plugin's settings are updated in the database without any administrator interaction.
• Frontend Change: When viewing the donation page, the "Bitcoin Address" displayed in the donation box now shows the attacker's address.

8. Verification Steps

1. Check Options Table:
   Use WP-CLI to verify the option value:
   wp option get cb_btc_address (inferred)
   Verify it matches 1AttackerAddressHere.
2. Frontend Inspection:
   browser_navigate("http://<target>/donation-page/")
   Inspect the donation box element to confirm the displayed address has changed.

9. Alternative Approaches

• Missing Nonce: If check_ajax_referer is entirely missing, the exploit is a trivial POST request with no nonce required.
• Different Actions: Search for other wp_ajax_nopriv actions such as cb_delete_log, cb_update_wallet, or cb_export_settings which might leak information or allow site disruption.
• Subscriber Access: If wp_ajax_nopriv is not present, test the wp_ajax_ (authenticated) version using a Subscriber account to see if the capability check is still missing.