Flowbox <= 1.1.5 - Missing Authorization

This research plan outlines the process for identifying and exploiting the Missing Authorization vulnerability in the Flowbox WordPress plugin (CVE-2025-49338).

1. Vulnerability Summary

The Flowbox plugin for WordPress (versions <= 1.1.5) fails to implement proper authorization checks (e.g., current_user_can()) in one or more functions reachable via WordPress AJAX or REST API endpoints. This allows unauthenticated users to trigger actions intended for administrators, such as modifying plugin settings, clearing caches, or updating API credentials.

2. Attack Vector Analysis

• Endpoint: https://<target>/wp-admin/admin-ajax.php (inferred) or a REST API route under wp-json/flowbox/v1/ (inferred).
• Action/Hook: The vulnerability likely resides in an AJAX handler registered with wp_ajax_nopriv_ or a wp_ajax_ handler that lacks a capability check.
• Authentication: None required (unauthenticated).
• Preconditions: The plugin must be active. A valid WordPress nonce may be required if the handler calls check_ajax_referer() or wp_verify_nonce().

3. Code Flow (Inferred)

1. Registration: The plugin registers an AJAX action in its main class (likely class-flowbox.php or includes/admin/class-admin.php):
   add_action( 'wp_ajax_nopriv_<action_name>', array( $this, 'vulnerable_function' ) );
2. Entry Point: An unauthenticated POST request is sent to admin-ajax.php with action=<action_name>.
3. Vulnerable Sink: The vulnerable_function executes without calling current_user_can( 'manage_options' ).
4. Impact: The function performs an operation like update_option( 'flowbox_settings', ... ), allowing the attacker to alter plugin configuration.

4. Nonce Acquisition Strategy

If the vulnerable function requires a nonce (e.g., via check_ajax_referer), it is likely exposed to the frontend via wp_localize_script.

1. Identify the Shortcode: Search the codebase for add_shortcode. Flowbox likely uses a shortcode to display galleries (e.g., [flowbox]).
2. Create a Trigger Page:

   wp post create --post_type=page --post_status=publish --post_title="Flowbox Test" --post_content='[flowbox]'
   

3. Navigate and Extract: Use the browser_navigate tool to go to the newly created page.
4. Extract Nonce: Search for the JS object containing the nonce.
   • Inferred Script Handle: flowbox-js or flowbox-admin.
   • Inferred JS Variable: window.flowbox_vars?.nonce or window.flowbox_params?.ajax_nonce.
   • Execution: browser_eval("window.flowbox_vars?.nonce")

5. Exploitation Strategy

Assuming the vulnerability allows updating plugin settings (a common "Missing Authorization" pattern for this plugin type):

1. Search for Action Names:
   Run grep -r "wp_ajax_nopriv" . in the plugin directory to find potential unauthenticated actions.
   • Candidate Action (Inferred): flowbox_save_settings or flowbox_update_config.
2. Construct Payload:
   Prepare a POST request to admin-ajax.php.
   • URL: https://<target>/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body: action=<action_name>&nonce=<extracted_nonce>&settings[flowbox_api_key]=MALICIOUS_KEY&settings[flowbox_username]=attacker_account
3. Execute Request: Use the http_request tool to send the payload.

6. Test Data Setup

1. Install and activate Flowbox <= 1.1.5.
2. Configure a dummy API key in the legitimate admin settings to establish a baseline.
3. Create a public page containing the Flowbox shortcode to ensure nonces are generated and accessible to unauthenticated visitors.

7. Expected Results

• Response: The server returns a 200 OK response, potentially with a JSON body like {"success": true} or 1.
• State Change: The plugin's internal settings (stored in the wp_options table) are updated with the attacker-supplied values.

8. Verification Steps

After the exploit attempt, verify the change using WP-CLI:

# Check the specific option name used by the plugin
wp option get flowbox_settings
# OR if settings are individual
wp option get flowbox_api_key

If the output matches the MALICIOUS_KEY provided in the payload, the exploit is successful.

9. Alternative Approaches

• REST API: If no wp_ajax actions are found, check register_rest_route. Search for routes where permission_callback is missing or returns __return_true.
• Parameter Fuzzing: If the action name is found but the parameters are unknown, inspect the callback function in the source code to identify which keys it reads from $_POST or $_REQUEST.
• Unauthenticated Option Update: Check if the function uses update_option() on a variable directly controlled by $_POST without filtering (this could also lead to more severe impacts).