Exploitation Research Plan - CVE-2025-63038

1. Vulnerability Summary

The WP Custom Admin Interface plugin (<= 7.40) contains a missing authorization vulnerability. While the plugin provides extensive customization of the WordPress admin dashboard (menus, toolbars, CSS, etc.), certain administrative functions — specifically those triggered via init or admin_init hooks — fail to verify that the requesting user has the manage_options capability. This allows an authenticated user with Subscriber-level permissions to perform unauthorized actions, such as resetting or deleting plugin configurations.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php (which triggers admin_init) or any frontend page (which triggers init).
• Vulnerable Action: The emergency configuration reset feature (wp-custom-admin-interface=delete-menu) and potentially the settings import/save functionality.
• Authentication: Subscriber-level (authenticated) access is required.
• Preconditions: The plugin must be active. For a visible impact, custom menu or toolbar settings should be configured.

3. Code Flow

1. Entry Point: A Subscriber user sends a request to the site.
2. Hook Registration: The plugin registers wp_custom_admin_interface_check_for_delete_menu (inferred name) on the init hook, or handles settings in wp_custom_admin_interface_settings_init registered on admin_init.
3. Vulnerable Function: The handler checks for the presence of a specific GET or POST parameter (e.g., $_GET['wp-custom-admin-interface'] == 'delete-menu').
4. Authorization Failure: The code likely uses is_user_logged_in() or no check at all, rather than current_user_can('manage_options').
5. Sink: The function calls delete_option('wp_custom_admin_interface_menu') or overwrites options via update_option().

4. Nonce Acquisition Strategy

Based on the plugin's FAQ and standard "emergency reset" patterns, the delete-menu action may not require a nonce to allow administrators to recover a broken site. However, if other settings actions are targeted:

1. Identify Script Localization: The plugin likely enqueues scripts for its admin pages. Use grep -r "wp_localize_script" . to find the localization variable.
2. Shortcode Creation: If nonces are only loaded on specific pages, find a shortcode (e.g., [wp_custom_admin_interface_...]) using grep "add_shortcode" ..
3. Page Setup:

   wp post create --post_type=page --post_status=publish --post_title="Nonce Page" --post_content='[shortcode_found]'
   

4. Extraction: Navigate to the page as the Subscriber and use browser_eval to extract the nonce:
   • Example: browser_eval("window.wp_custom_admin_interface_data?.nonce") (inferred variable name).

5. Exploitation Strategy

The primary goal is to demonstrate unauthorized configuration deletion.

Step 1: Configuration Reset (Highest Probability)

1. Action: Perform a GET request to the homepage with the reset parameter.
2. Request:

   GET /?wp-custom-admin-interface=delete-menu HTTP/1.1
   Host: localhost:8080
   Cookie: [Subscriber Cookies]
   

3. Expected Response: A redirect (302) to the admin dashboard, and the deletion of the wp_custom_admin_interface_menu option.

Step 2: Unauthorized Settings Modification (AJAX)

If the above fails, target the AJAX settings handler.

1. Action: Search for wp_ajax_ handlers in the source.
2. Target Function: wp_ajax_wp_custom_admin_interface_save_settings (inferred).
3. Payload: Attempt to change the wp_custom_admin_interface_general_settings (inferred) to modify the footer text.
4. Request:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   Cookie: [Subscriber Cookies]
   
   action=wp_custom_admin_interface_save_settings&footer_text=Hacked+by+Subscriber
   

6. Test Data Setup

1. Install & Activate: Ensure version 7.40 is installed.
2. Configure Admin Interface:

   # Create a dummy menu configuration to be deleted
   wp option update wp_custom_admin_interface_menu '{"test_menu": "modified"}'
   

3. Create User:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
   

7. Expected Results

• Success (Reset): The wp_custom_admin_interface_menu option is deleted or returned to default values in the database.
• Success (Modification): The plugin settings are updated despite the user lacking administrative privileges.
• Response: The server returns a success code (200) or a redirect (302) instead of a forbidden (403).

8. Verification Steps

1. Check Option Deletion:

   wp option get wp_custom_admin_interface_menu
   # If the exploit worked, this will return 'false' or the default value.
   

2. Check Settings Modification:

   wp option get wp_custom_admin_interface_general_settings
   # Verify if the injected footer_text or other parameter is present.
   

9. Alternative Approaches

If the delete-menu parameter is not processed via init, check for a direct POST handler in wp_custom_admin_interface_settings_init which is hooked to admin_init. Subscribers can trigger admin_init by visiting /wp-admin/admin-ajax.php. Send a POST request to that endpoint with parameters like wp_custom_admin_interface_export or wp_custom_admin_interface_import to test for other authorization gaps.