Enter Addons <= 2.3.2 - Cross-Site Request Forgery

This research plan outlines the steps to analyze and exploit a Cross-Site Request Forgery (CSRF) vulnerability in the Enter Addons – Ultimate Template Builder for Elementor plugin.

1. Vulnerability Summary

• Vulnerability: Cross-Site Request Forgery (CSRF)
• Plugin: Enter Addons – Ultimate Template Builder for Elementor (slug: enteraddons)
• Affected Versions: <= 2.3.2
• Root Cause: The plugin registers AJAX actions for administrative tasks (such as saving plugin settings or toggling features) without performing proper nonce validation (either missing check_ajax_referer or using an incorrect action string). This allows an attacker to perform state-changing actions by tricking a logged-in administrator into visiting a malicious URL or submitting a form.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action (Inferred): enter_addons_save_admin_settings or enter_addons_extension_control. These are common entry points for settings management in this plugin.
• HTTP Method: POST
• Required Authentication: Administrator (victim of the CSRF).
• Impact: Unauthorized modification of plugin settings, enabling/disabling widgets, or altering template configurations.

3. Code Flow (Inferred)

1. Registration: The plugin registers an AJAX handler in its main class or an admin-specific class (e.g., includes/admin/Admin.php or includes/Admin/Admin_Settings.php).
   • add_action('wp_ajax_enter_addons_save_admin_settings', [$this, 'save_admin_settings']);
2. Handler Execution: The save_admin_settings function is invoked when a request to admin-ajax.php with action=enter_addons_save_admin_settings is made.
3. Vulnerable Point: The handler function likely lacks a check_ajax_referer('enteraddons_nonce', 'security') call at the beginning of the function.
4. Sinks: The function proceeds to process $_POST['fields'] or similar parameters and updates the WordPress database using update_option('enter_addons_settings', ...).

4. Nonce Acquisition Strategy

While the vulnerability is CSRF (implying the victim will provide the nonce if one exists, or that the check is missing), for the purpose of a Proof-of-Concept, we must determine if a nonce is required at all or if the check is bypassable.

1. Identify Localized Data: The plugin likely localizes a nonce for its admin dashboard.
2. Creation of Test Page:
   • Since the admin settings are only accessible in the backend, we will use the browser_navigate tool to access the Enter Addons settings page.
3. Extraction via browser_eval:
   • Navigate to: /wp-admin/admin.php?page=enter-addons-settings
   • Execute JS to find the localized object: browser_eval("window.enter_addons_admin_ajax") (inferred name).
   • Check for keys like nonce or security.
   • Note: If the check is entirely missing, we can proceed without any nonce.

5. Exploitation Strategy

We will attempt to disable a specific plugin feature (e.g., the "Accordion" widget) via CSRF.

Step 1: Discover the settings structure
Use wp option get enter_addons_settings via WP-CLI to see current settings.

Step 2: Craft the Exploit Request
We will use the http_request tool to simulate the CSRF. In a real-world scenario, this would be an auto-submitting HTML form on an attacker's site.

• URL: http://[target]/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Payload (Example):

  action=enter_addons_save_admin_settings&fields[widgets][accordion]=false&fields[widgets][button]=false
  

  (Note: Parameter names are inferred from common "Ultimate Addons" patterns and must be verified during the research phase using browser_eval on the settings page form).

6. Test Data Setup

1. Install/Activate: Ensure enteraddons version 2.3.2 is installed and active.
2. Administrator Session: Ensure the automated agent is logged in as an administrator to mimic the victim.
3. Initial State: Enable all widgets in the Enter Addons dashboard.

7. Expected Results

• HTTP Response: The admin-ajax.php request should return a 200 OK response, often with a JSON body like {"success": true} or 1.
• Database Change: The enter_addons_settings option in the wp_options table should be updated to reflect the disabled features.

8. Verification Steps

After the http_request is sent, verify the modification via WP-CLI:

wp option get enter_addons_settings

Check if the values specified in the fields parameter have been successfully updated in the database.

9. Alternative Approaches

If enter_addons_save_admin_settings is not the correct action name:

1. Check Extension Control: Try action=enter_addons_extension_control.
2. Examine Network Traffic: Use browser_navigate to the plugin settings page, toggle a setting manually, and use the browser's developer tools (simulated via agent logging) to identify the exact AJAX action and parameter names used.
3. Missing vs. Incorrect: If a nonce is checked but the action string is incorrect, find another nonce on the page (like the standard WP heartbeat or menu nonce) and try substituting it. However, the report indicates "missing or incorrect," suggesting a complete lack of a valid check.