Exploitation Research Plan - CVE-2025-68072

1. Vulnerability Summary

The Easy Property Listings plugin (<= 3.5.20) is vulnerable to Missing Authorization. The plugin registers an AJAX action for unauthenticated users (wp_ajax_nopriv_) that performs an administrative or state-changing task without a current_user_can() check.

Based on the CVSS score (5.3 - Integrity Low, No Confidentiality impact), the vulnerability likely allows an unauthenticated attacker to dismiss administrative notices, modify minor UI-related settings, or trigger non-destructive administrative actions. The most probable target is the notice dismissal mechanism, which is frequently registered with wp_ajax_nopriv_ in this plugin family but lacks a capability check to ensure only admins can dismiss global alerts.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: epl_dismiss_notice (inferred from plugin patterns)
• HTTP Method: POST
• Authentication: Unauthenticated (nopriv)
• Parameters:
  • action: epl_dismiss_notice
  • security: (A WordPress nonce)
  • notice_id: The identifier of the notice to dismiss (e.g., epl_welcome_notice)
• Preconditions: A valid nonce must be obtained from the frontend.

3. Code Flow

1. Registration: The plugin registers the AJAX handler in lib/includes/class-epl-ajax.php (or similar) using:
   add_action( 'wp_ajax_nopriv_epl_dismiss_notice', array( $this, 'epl_dismiss_notice' ) );
2. Entry Point: A POST request to admin-ajax.php with action=epl_dismiss_notice triggers the function.
3. Nonce Check: The function likely calls check_ajax_referer( 'epl_ajax_nonce', 'security' ). Because the nonce is generated for uid=0 and exposed on the frontend, unauthenticated users can provide a valid one.
4. Vulnerable Sink: The function proceeds to update the database (e.g., update_option() or update_user_meta()) to mark a notice as dismissed without calling current_user_can( 'manage_options' ).

4. Nonce Acquisition Strategy

The plugin localizes its AJAX configuration, including the nonce, on pages where property listings are displayed.

1. Shortcode: The primary shortcode is [listing].
2. Page Creation: Create a public page containing the shortcode.
   wp post create --post_type=page --post_status=publish --post_title="Listings" --post_content='[listing]'
3. Navigation: Use the browser_navigate tool to go to the newly created page.
4. Extraction: Use browser_eval to extract the nonce from the global JavaScript object epl_vars.
   • JS Variable: window.epl_vars
   • Key: ajax_nonce
   • Command: browser_eval("window.epl_vars?.ajax_nonce")

5. Exploitation Strategy

Step 1: Obtain Nonce

As described above, navigate to a page with an EPL shortcode and extract epl_vars.ajax_nonce.

Step 2: Send Unauthorized Action Request

Use the http_request tool to send a spoofed dismissal request.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers:
  • Content-Type: application/x-www-form-urlencoded
• Body:
  action=epl_dismiss_notice&security=[EXTRACTED_NONCE]&notice_id=epl_welcome_notice

6. Test Data Setup

1. Plugin Installation: Ensure Easy Property Listings <= 3.5.20 is installed and active.
2. Create Target Content: Create a property listing to ensure the frontend scripts load correctly.
   wp post create --post_type=property --post_title="Test Property" --post_status=publish
3. Public Page: Create the page for nonce extraction.
   wp post create --post_type=page --post_status=publish --post_title="Exploit Page" --post_content='[listing]'

7. Expected Results

• Response: The AJAX request should return a successful response (usually 1 or a JSON success object).
• Impact: An administrative notice (like the "Welcome to Easy Property Listings" notice) will be dismissed site-wide or for the site owner, despite the request coming from an unauthenticated source.

8. Verification Steps

After performing the exploit, verify the state change via WP-CLI:

• Check if the notice ID is now present in the dismissed notices option:
  wp option get epl_dismissed_notices
• Alternatively, if stored in user meta (for user ID 1, the admin):
  wp user meta get 1 epl_dismissed_notices

9. Alternative Approaches

If epl_dismiss_notice is not the target, investigate other AJAX actions registered with nopriv in lib/includes/class-epl-ajax.php:

• epl_ajax_save_search: Check if an unauthenticated user can save arbitrary searches or modify search parameters for other users.
• epl_process_diagnostic_data: Check if unauthenticated users can trigger diagnostic processes that modify system logs.
• If no nopriv actions are found, check the REST API controllers (usually in lib/includes/api/) for permission_callback functions that return __return_true.