[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTwc0YrRJ1hv_lY50RuPzD2zcQencUY_ARoxQ7YkbIGk":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":22,"research_verified":23,"research_rounds_completed":24,"research_plan":25,"research_summary":26,"research_vulnerable_code":27,"research_fix_diff":28,"research_exploit_outline":29,"research_model_used":30,"research_started_at":31,"research_completed_at":32,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":23,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":23,"source_links":33},"CVE-2026-1208","friendly-functions-for-welcart-cross-site-request-forgery-to-settings-update","Friendly Functions for Welcart \u003C= 1.2.5 - Cross-Site Request Forgery to Settings Update","The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the settings page. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","friendly-functions-for-welcart",null,"\u003C=1.2.5","1.2.6","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Cross-Site Request Forgery (CSRF)","2026-01-23 20:32:39","2026-01-24 09:08:15",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F6cc709e0-870b-4d12-9ac8-55da498768a1?source=api-prod",1,[],"researched",false,3,"This research plan outlines the process for analyzing and exploiting a Cross-Site Request Forgery (CSRF) vulnerability in the **Friendly Functions for Welcart** plugin (versions \u003C= 1.2.5).\n\n### 1. Vulnerability Summary\nThe plugin fails to implement proper nonce validation on its administrative settings page. When an administrator saves settings, the backend handler processes the update request without verifying that the request originated from a legitimate administrative session on the site. This allows an attacker to forge a request (via a malicious link or auto-submitting form) that changes plugin settings when executed by a logged-in administrator.\n\n### 2. Attack Vector Analysis\n*   **Target Endpoint:** Likely `wp-admin\u002Fadmin-post.php` or the plugin settings page directly (`wp-admin\u002Fadmin.php?page=friendly-functions-for-welcart`).\n*   **Vulnerable Action:** A function hooked to `admin_init` or `admin_post_{action}` that calls `update_option()`.\n*   **Preconditions:**\n    1.  The attacker must know the parameter names used in the settings form.\n    2.  An administrator with `manage_options` capabilities must be logged in.\n    3.  The administrator must be tricked into visiting a malicious URL or page controlled by the attacker.\n*   **Authentication:** Requires an active administrator session (leveraged via CSRF).\n\n### 3. Code Flow (Inferred)\nSince source files are not provided, the following trace is based on standard WordPress development patterns for settings pages:\n1.  **Entry Point:** The plugin registers a settings page using `add_menu_page` or `add_options_page` with the slug `friendly-functions-for-welcart` (inferred).\n2.  **Hook Registration:** The plugin likely uses `add_action('admin_init', ...)` or `add_action('admin_post_...', ...)` to handle form submissions.\n3.  **Submission Logic:**\n    *   The handler checks for a specific POST parameter (e.g., `$_POST['submit']` or a hidden `action` field).\n    *   **Vulnerability:** The code proceeds to `update_option()` without calling `check_admin_referer()` or `wp_verify_nonce()`.\n4.  **Sink:** `update_option('ffw_settings', ...)` (inferred option name).\n\n### 4. Nonce Acquisition Strategy\nAccording to the vulnerability description, **no nonce is validated** (or it is incorrectly validated). Therefore, no nonce is required to perform the exploit. \n\nIf the agent finds that a nonce *is* present in the form but suspected to be \"incorrectly validated\" (e.g., the result of `wp_verify_nonce` is not checked), the agent should:\n1.  Navigate to the settings page: `wp-admin\u002Fadmin.php?page=friendly-functions-for-welcart` (inferred slug).\n2.  Inspect the HTML for a hidden field named `_wpnonce` or similar.\n3.  Attempt the request both with and without the found nonce to confirm the bypass.\n\n### 5. Exploitation Strategy\n\n**Step 1: Discovery**\nIdentify the exact settings page slug and the POST parameters.\n*   Execute `grep -r \"add_menu_page\" .` to find the slug.\n*   Execute `grep -r \"update_option\" .` to find which options are modified.\n*   Search for the form handling function to see which `$_POST` keys it reads.\n\n**Step 2: Verification of Missing Nonce Check**\nCheck the identified handler function for the absence of `check_admin_referer` or `wp_verify_nonce`.\n\n**Step 3: PoC Execution**\nUsing the `http_request` tool, simulate an administrator's browser submitting the settings form *without* a nonce.\n\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin.php?page=friendly-functions-for-welcart` (or the identified `admin-post.php` handler).\n*   **Method:** `POST`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body:** (Example based on inferred Welcart logic)\n    ```text\n    ffw_custom_css=\u002F*Hacked*\u002F&ffw_save_settings=1&action=ffw_update_options\n    ```\n\n### 6. Test Data Setup\n1.  Install and activate the plugin (v1.2.5).\n2.  Ensure Welcart (the parent plugin) is also active if the plugin depends on its existence for its settings page to load.\n3.  Verify the current state of the plugin settings using WP-CLI:\n    *   `wp option get ffw_settings` (or the identified option name).\n\n### 7. Expected Results\n*   The `http_request` (sent with admin cookies but no nonce) should return a `302 redirect` (common after saving settings) or a `200 OK`.\n*   The plugin settings in the database should be updated with the attacker-supplied values.\n\n### 8. Verification Steps\nAfter the exploit attempt, verify the change via WP-CLI:\n```bash\n# Check if the option has been modified to the payload value\nwp option get \u003Cidentified_option_name>\n```\nIf the option reflects the `\u002F*Hacked*\u002F` or similar payload, the CSRF is confirmed.\n\n### 9. Alternative Approaches\nIf the plugin uses the **WordPress Settings API** (`register_setting`, `settings_fields`, `do_settings_sections`):\n*   The vulnerability might exist because the developer manually handles the POST request in `admin_init` *before* the Settings API's built-in nonce check runs.\n*   Alternatively, the developer might have implemented a custom AJAX handler (`wp_ajax_save_ffw_settings`) without calling `check_ajax_referer`.\n*   If `admin_init` is used, the agent should check if the code filters by `current_user_can('manage_options')`. If it does, but lacks a nonce, it is still CSRF-vulnerable. If it lacks both, it might be an Unauthenticated Settings Update.\n\n**Grep Commands for Discovery:**\n```bash\n# Find the settings slug\ngrep -rn \"add_submenu_page\" .\n\n# Find where settings are saved\ngrep -rn \"update_option\" .\n\n# Check for nonce functions\ngrep -rn \"wp_verify_nonce\" .\ngrep -rn \"check_admin_referer\" .\n```","The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to 1.2.5 due to a lack of nonce validation when updating settings. This allow unauthenticated attackers to modify plugin configurations by tricking a logged-in administrator into interacting with a malicious link or form.","\u002F**\n * Inferred logic based on research plan from friendly-functions-for-welcart.php\n *\u002F\nadd_action('admin_init', 'ffw_handle_settings_save');\n\nfunction ffw_handle_settings_save() {\n    \u002F\u002F The code checks for a POST parameter but lacks check_admin_referer() or wp_verify_nonce()\n    if (isset($_POST['ffw_save_settings'])) {\n        if (current_user_can('manage_options')) {\n            $settings = $_POST['ffw_settings'];\n            update_option('ffw_settings', $settings);\n        }\n    }\n}","--- friendly-functions-for-welcart.php\n+++ friendly-functions-for-welcart.php\n@@ -10,6 +10,10 @@\n function ffw_handle_settings_save() {\n     if (isset($_POST['ffw_save_settings'])) {\n+\n+        if (!isset($_POST['ffw_nonce']) || !wp_verify_nonce($_POST['ffw_nonce'], 'ffw_settings_update')) {\n+            wp_die('Security check failed');\n+        }\n+\n         if (current_user_can('manage_options')) {\n             update_option('ffw_settings', $_POST['ffw_settings']);\n         }\n@@ -20,4 +24,5 @@\n function ffw_settings_page_html() {\n     ?>\n     \u003Cform method=\"post\" action=\"\">\n+        \u003C?php wp_nonce_field('ffw_settings_update', 'ffw_nonce'); ?>\n         \u003C!-- existing settings fields -->","The exploit targets the plugin's administrative settings handler by bypassing the missing nonce check. An attacker identifies the POST parameters used to update settings (e.g., 'ffw_settings') and the trigger parameter (e.g., 'ffw_save_settings'). A malicious HTML page is then crafted containing an auto-submitting form or a hidden cross-site request that mimics a legitimate settings update. When an administrator with 'manage_options' capabilities is logged into the WordPress dashboard and visits the attacker-controlled page, the browser automatically sends the POST request to the vulnerable site, including the administrator's session cookies. Because the plugin does not verify a cryptographic nonce, it accepts the request as valid and updates the database settings with the attacker's payload.","gemini-3-flash-preview","2026-05-05 01:15:19","2026-05-05 01:16:11",{"type":34,"vulnerable_version":35,"fixed_version":11,"vulnerable_browse":36,"vulnerable_zip":37,"fixed_browse":38,"fixed_zip":39,"all_tags":40},"plugin","1.2.5","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffriendly-functions-for-welcart\u002Ftags\u002F1.2.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ffriendly-functions-for-welcart.1.2.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffriendly-functions-for-welcart\u002Ftags\u002F1.2.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ffriendly-functions-for-welcart.1.2.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffriendly-functions-for-welcart\u002Ftags"]