Exploitation Research Plan: CVE-2026-24625 (Missing Authorization in File Uploads Addon for WooCommerce)

1. Vulnerability Summary

The File Uploads Addon for WooCommerce plugin (versions <= 1.7.3) contains a missing authorization vulnerability in its file download handling logic. The plugin registers an admin_post action named wau_secure_download for both authenticated and unauthenticated (nopriv) users. This action points to the wau_secure_file_download function in the wau_front_end_class. Because this function lacks a capability check (e.g., current_user_can( 'manage_options' )) or ownership validation, any unauthenticated user can trigger the download of files uploaded by other customers by providing the appropriate file path or URL parameter.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-post.php
• Action: wau_secure_download
• Hook (Authenticated): admin_post_wau_secure_download
• Hook (Unauthenticated): admin_post_nopriv_wau_secure_download (Vulnerable Entry Point)
• HTTP Method: GET (typically used for download links)
• Parameters:
  • action=wau_secure_download
  • wau_file_url (Inferred based on plugin naming conventions and wau_add_item_meta_url function)
• Authentication: None required (unauthenticated).

3. Code Flow

1. Entry Point: An unauthenticated user sends a request to wp-admin/admin-post.php?action=wau_secure_download&wau_file_url=....
2. Hook Registration: In includes/class-wau-front-end.php, the __construct method of wau_front_end_class registers the action:

   add_action( 'admin_post_wau_secure_download', array( $this, 'wau_secure_file_download' ) );
   add_action( 'admin_post_nopriv_wau_secure_download', array( $this, 'wau_secure_file_download' ) );
   

3. Execution: WordPress triggers the wau_secure_file_download method.
4. Vulnerable Sink: The wau_secure_file_download function (located in includes/class-wau-front-end.php) fails to verify if the requesting user has the manage_woocommerce capability or if the user is the owner of the order associated with the file.
5. Output: The function reads the file path from the request and pipes the file content to the browser using readfile() or similar, allowing unauthorized access to customer-uploaded images/documents.

4. Nonce Acquisition Strategy

While admin_post handlers should use nonces for CSRF protection, the "Missing Authorization" nature of this vulnerability often implies the handler is completely open. If a nonce is required, it is likely the one generated for the "secure" link in the order metadata.

However, if the plugin enqueues a nonce for its front-end actions, it would be localized via wau_front_end_scripts_js.

• Search for Nonce: Use grep -r "wp_create_nonce" includes/ to find if a specific nonce is used for downloads.
• Product Page Nonce: The product page contains a nonce for uploading: wau_file_upload.
  • Variable: wau_file_upload_nonce
  • Action: wau_file_upload
• Strategy: If the download handler requires a nonce, first navigate to a product page where the addon is active, and extract the nonce using:

  browser_eval("document.querySelector('#wau_file_upload_nonce')?.value")
  

5. Exploitation Strategy

Step 1: Discover Parameters

Since the source for wau_secure_file_download is truncated, use the grep tool to find the parameter used for the file path:

grep -n "wau_secure_file_download" includes/class-wau-front-end.php -A 20

Identify if it uses $_GET['wau_file_url'], $_GET['filepath'], or similar.

Step 2: Create Test Data

1. Enable the addon in settings: wp option update wau_addon_settings '{"wau_enable_addon":"1"}' --format=json
2. Create a product: wp post create --post_type=product --post_title="Upload Product" --post_status=publish
3. As a visitor, navigate to the product and upload a file named secret_receipt.jpg.
4. Note the location. Files are typically stored in wp-content/uploads/wau-uploads/.

Step 3: Trigger Unauthorized Download

Using the http_request tool, perform an unauthenticated GET request to admin-post.php.

Request Structure (Example):

GET /wp-admin/admin-post.php?action=wau_secure_download&wau_file_url=http://localhost:8080/wp-content/uploads/wau-uploads/secret_receipt.jpg HTTP/1.1
Host: localhost:8080

Note: The wau_file_url might be a relative path or an encrypted string. If it's a path, try directory traversal (e.g., ../../../../wp-config.php) if the plugin fails to sanitize the input.

6. Test Data Setup

1. Plugin Settings: Ensure wau_enable_addon is set to 1 in the wau_addon_settings option.
2. Product: Create a product with ID 123.
3. Upload: Perform a multipart/form-data POST to the product page with a file in the wau_file_addon field and the wau_file_upload_nonce found in the HTML.
4. Capture File Path: Check the wp_wau_uploads database table (if it exists) or the woocommerce_order_itemmeta table to find the file path/URL generated for an order.

7. Expected Results

• Success: The server responds with HTTP 200 OK and the binary content of the file (e.g., Content-Type: image/jpeg).
• Failure: The server responds with HTTP 403 Forbidden, HTTP 302 redirecting to login, or an "Unauthorized" error message.

8. Verification Steps

1. Check Content: Verify that the downloaded file content matches the file uploaded during setup.
2. Verify Unauthenticated: Ensure the http_request does not include any session cookies (wordpress_logged_in_*).
3. Check Capability: After patching, the same request should fail for non-admin users.

9. Alternative Approaches

• Path Traversal: If wau_secure_file_download uses a raw file path in a parameter like file=..., try accessing /etc/passwd or wp-config.php.
• Insecure Direct Object Reference (IDOR): If the plugin uses an ID (e.g., ?action=wau_secure_download&id=45), iterate through IDs to download all uploaded files in the system.
• Nonce Bypass: If the handler checks wp_verify_nonce( $_GET['nonce'], -1 ), any nonce generated with the default action -1 (found in various WP pages) will satisfy the check. (Check includes/class-wau-front-end.php for the specific wp_verify_nonce call).