Research Plan: CVE-2025-11370 - Depicter Unauthorized Display Rule Updates

1. Vulnerability Summary

The Depicter plugin (versions <= 4.0.7) contains a missing authorization vulnerability in the RulesAjaxController::store method. This vulnerability allows unauthenticated attackers to modify the display rules (e.g., where a popup appears, timing, audience targeting) of any slider or popup created with the plugin. The flaw exists because the AJAX handler responsible for saving rules fails to verify the user's capabilities, and likely exposes a nopriv (unauthenticated) AJAX action or fails to properly protect the authenticated one.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: depicter_ajax (inferred based on Depicter's common dispatcher pattern)
• Parameters:
  • controller: rules (inferred)
  • method: store (referenced in the CVE description)
  • nonce: A security nonce (required if check_ajax_referer is present).
  • data: Likely a JSON object or array containing slider_id and the new rules configuration.
• Authentication: Unauthenticated (via wp_ajax_nopriv_ registration).
• Preconditions: At least one Depicter slider or popup must exist on the site for its rules to be modified.

3. Code Flow (Inferred)

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php.
2. Hook Registration: The plugin registers an AJAX action:
   add_action('wp_ajax_nopriv_depicter_ajax', array($dispatcher, 'handle'));
3. Dispatcher: The dispatcher parses the controller and method parameters.
4. Vulnerable Sink: The dispatcher calls RulesAjaxController->store().
5. Missing Check: Inside store(), the code likely retrieves the slider ID and rule data from $_POST['args'] or $_POST['data'] and saves them to the database (likely in the wp_depicter_sliders table or via update_post_meta) without calling current_user_can('manage_options').

4. Nonce Acquisition Strategy

Depicter typically localizes a common configuration object for its editor and frontend.

1. Identify Shortcode: The plugin uses [depicter id="ID_HERE"].
2. Create Test Page:
   wp post create --post_type=page --post_status=publish --post_title="Depicter Test" --post_content='[depicter id="1"]' (Replace 1 with an actual slider ID).
3. Extract Nonce: Use the browser to find the localized script data.
   • Variable Name: depicterCommon or depicterRules (inferred).
   • Extraction Command:
     browser_eval("window.depicterCommon?.nonce || window.depicter_ajax?.nonce")
4. Action Check: If the wp_ajax_nopriv_ action is used, the nonce is likely generated with an action string like depicter_ajax_nonce or depicter-nonce.

5. Exploitation Strategy

The goal is to modify the display rules of an existing slider to show it on every page, potentially for defacement or to inject malicious links if the rules allow custom HTML/content display.

Step-by-Step Plan:

1. Identify Target Slider: Use wp_cli to find an existing slider ID:
   wp db query "SELECT id FROM wp_depicter_sliders LIMIT 1;"
2. Obtain Nonce: Navigate to any page where Depicter is loaded and extract the nonce using browser_eval.
3. Craft Payload: The store method likely expects a payload representing display logic.
   • URL: http://vulnerable-wp.local/wp-admin/admin-ajax.php
   • Method: POST
   • Body (URL-encoded):

     action=depicter_ajax
     &controller=rules
     &method=store
     &nonce=[EXTRACTED_NONCE]
     &args[slider_id]=[TARGET_ID]
     &args[rules]={"display":{"all":true},"trigger":{"time":0}}
     

     (Note: Exact args structure must be verified by inspecting the RulesAjaxController.php file in the plugin directory.)

6. Test Data Setup

1. Install Depicter: Ensure Depicter <= 4.0.7 is active.
2. Create a Slider: Use the plugin UI or wp_cli to create a basic slider so a record exists in the database.
3. Publish Slider: Note the ID (e.g., 1).
4. Create Public Page: Create a page containing the slider shortcode to ensure nonces are generated and accessible to unauthenticated users.

7. Expected Results

• Response: The server should return a 200 OK with a JSON response, likely {"success": true}.
• State Change: The display rules for the slider in the database will be updated to the values provided in the attack payload.

8. Verification Steps

1. Database Check: Query the database to see if the rules changed for the specific slider:
   wp db query "SELECT rules FROM wp_depicter_sliders WHERE id = [TARGET_ID];"
2. Frontend Observation: Visit the site homepage (or a page where the slider wasn't previously supposed to show) and verify that the slider now appears based on the new "Display Everywhere" rule.

9. Alternative Approaches

• Check for direct Rule Controller: If the dispatcher depicter_ajax is not the entry point, check for direct action registrations like wp_ajax_nopriv_depicter_rules_store.
• JSON Payload: Some Depicter versions may expect the entire body as a JSON object rather than standard POST parameters. If application/x-www-form-urlencoded fails, try application/json.
• Parameter Names: If args or data fails, search the plugin source for $_POST or $_REQUEST in app/Controller/Ajax/RulesAjaxController.php to identify the correct parameter names.