Exploitation Research Plan: CVE-2025-14288

1. Vulnerability Summary

The Mixed Media Gallery Blocks plugin (simply-gallery-block) for WordPress is vulnerable to an authorization bypass. The plugin's AJAX handler pgc_sgb_action_wizard checks for the edit_posts capability rather than manage_options when performing the update_option action. This allows any user with at least Contributor level permissions to modify arbitrary WordPress options that begin with the pgc_sgb_ prefix.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: pgc_sgb_action_wizard
• Vulnerable Parameter: option_name and option_value (when action_type is update_option)
• Authentication: Authenticated (Contributor+)
• Capability Required: edit_posts
• Preconditions: The attacker must possess a valid nonce for the pgc_sgb_action_wizard action.

3. Code Flow

1. The AJAX request is sent to admin-ajax.php with action=pgc_sgb_action_wizard.
2. The handler (likely pgc_sgb_action_wizard() in the plugin's main files or an AJAX class) is invoked.
3. The code performs a capability check: current_user_can( 'edit_posts' ). Since Contributors can edit their own posts, this check passes.
4. The code checks the action_type parameter. If it is update_option, it proceeds.
5. The code likely checks if the provided option_name starts with pgc_sgb_.
6. It calls update_option( $_POST['option_name'], $_POST['option_value'] ) without verifying if the user has manage_options permissions.

4. Nonce Acquisition Strategy

The pgc_sgb_wizard_nonce is required for this request. Since this wizard is likely used in the block editor or plugin settings page, the nonce will be localized for logged-in users.

1. User Role: Authenticate as a Contributor.
2. Post Creation: Create a post to ensure the Gutenberg editor (and the plugin's block scripts) are loaded.

   wp post create --post_type=post --post_status=draft --post_title="Exploit Page" --post_author=[CONTRIBUTOR_ID]
   

3. Navigation: Navigate to the edit page for that post.
4. JS Extraction: Use browser_eval to extract the nonce. The localization key is likely associated with the plugin slug simply-gallery-block.
   • Guessed JS Variable (Inferred): pgc_sgb_vars.nonce or SimplyGalleryBlock?.nonce.
   • Verification: Inspect the page source for wp_localize_script calls containing pgc_sgb_wizard_nonce.

5. Exploitation Strategy

Once the nonce is obtained, the attacker sends a crafted POST request to admin-ajax.php.

HTTP Request:

• URL: http://[TARGET]/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=pgc_sgb_action_wizard&
  pgc_sgb_wizard_nonce=[NONCE]&
  action_type=update_option&
  option_name=pgc_sgb_some_setting&
  option_value=malicious_payload
  

Targeted Setting (Example):
While pgc_sgb_ settings are prefixed, modifying them can still impact site behavior.

• pgc_sgb_lightbox_theme: Change the look of the site.
• pgc_sgb_settings: If this stores a JSON object of all settings, an attacker can overwrite the entire plugin configuration.

6. Test Data Setup

1. Target Version: Ensure Mixed Media Gallery Blocks <= 3.3.0 is installed.
2. User: Create a contributor user.

   wp user create attacker attacker@example.com --role=contributor --user_pass=password
   

3. Plugin Activation: Ensure the plugin is active.

   wp plugin activate simply-gallery-block
   

7. Expected Results

• Success: The server returns a success response (likely a JSON {"success": true} or 1).
• Persistence: The targeted option in the wp_options table is updated with the attacker's value.

8. Verification Steps

After the exploit, verify the change using WP-CLI:

wp option get pgc_sgb_some_setting

The output should match the option_value sent in the payload.

9. Alternative Approaches

If update_option is restricted by a more specific whitelist than just the pgc_sgb_ prefix, investigate other action_type branches within the pgc_sgb_action_wizard function. Common wizard patterns often include:

• delete_option: To break plugin functionality.
• get_option: To leak configuration details.
• reset_settings: To revert the plugin to insecure defaults.

Trace the pgc_sgb_action_wizard function for any switch or if/else statements handling the action_type parameter to identify these alternatives.