Livemesh Addons by Elementor <= 9.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Plugin Settings

This research plan outlines the steps to exploit CVE-2026-1572, a missing authorization and stored XSS vulnerability in the Livemesh Addons for Elementor plugin.

---

1. Vulnerability Summary

The lae_admin_ajax() function in the Livemesh Addons for Elementor plugin fails to implement a capability check (e.g., current_user_can('manage_options')). This AJAX handler is used to update plugin settings. While it likely employs a nonce for CSRF protection, the plugin also suffers from improper access control, allowing low-privileged users (Subscribers) to access the settings page where the nonce is exposed. Furthermore, settings related to checkboxes are not properly sanitized before being stored and are not escaped when rendered on the settings page, leading to Stored Cross-Site Scripting (XSS).

2. Attack Vector Analysis

• AJAX Action: lae_admin_ajax
• Endpoint: /wp-admin/admin-ajax.php
• Authentication: Authenticated (Subscriber level or higher).
• Vulnerable Parameter: Likely a nested array in $_POST (e.g., settings or widgets_status) containing checkbox values.
• Preconditions:
  1. The attacker must have a valid Subscriber account.
  2. The attacker must obtain a valid nonce (leaked via the admin settings page accessible to Subscribers).

3. Code Flow (Inferred)

1. Entry: A POST request is sent to admin-ajax.php with action=lae_admin_ajax.
2. Dispatch: WordPress executes the hook wp_ajax_lae_admin_ajax.
3. Handler: The function lae_admin_ajax() (likely in includes/admin/class-lae-admin-settings.php or similar) is called.
4. Verification: The code calls check_ajax_referer('lae-admin-settings-nonce', 'security') (inferred nonce action and parameter). It fails to call current_user_can().
5. Sink (Storage): The handler iterates through $_POST['settings'] and saves them using update_option('lae_settings', ...).
6. Sink (Output): When an Administrator visits the settings page (slug: lae-settings), the plugin retrieves the option and echoes the malicious value inside an HTML attribute (e.g., <input value="[XSS]">) without using esc_attr().

4. Nonce Acquisition Strategy

The vulnerability description explicitly mentions that the nonce is leaked via improper access control on settings pages.

1. Identify Settings Page: The plugin settings page slug is likely lae-settings.
2. Access as Subscriber: Navigate to /wp-admin/admin.php?page=lae-settings using a Subscriber session.
3. Extract Nonce:
   • The nonce is likely localized via wp_localize_script.
   • Use browser_navigate to the settings page.
   • Use browser_eval to find the nonce: browser_eval("window.lae_settings_vars?.lae_admin_nonce") (inferred JS object name).
   • Alternatively, check for a hidden input: browser_eval("document.querySelector('#lae_settings_nonce')?.value").

5. Exploitation Strategy

1. Setup: Create a Subscriber user and log in.
2. Nonce Retrieval: Access the settings page as the Subscriber and extract the security or nonce parameter.
3. Injection: Send a crafted AJAX request to modify a checkbox setting with an XSS payload.
   • Tool: http_request
   • Method: POST
   • URL: http://[target]/wp-admin/admin-ajax.php
   • Body (URL-encoded):

     action=lae_admin_ajax
     &security=[EXTRACTED_NONCE]
     &settings[some_widget_checkbox]="><script>alert(document.domain)</script>
     

   • Content-Type: application/x-www-form-urlencoded
4. Trigger: Log in as an Administrator and navigate to the plugin settings page.

6. Test Data Setup

1. User: Create a user with the subscriber role.
2. Plugin Configuration: Ensure the Livemesh Addons for Elementor plugin (v9.0 or below) is active.
3. Page Creation: (Optional) If the settings page is not directly accessible, check if the nonce is available on the dashboard or any page where the plugin enqueues admin scripts.

7. Expected Results

• The AJAX request should return a success status (e.g., {"success": true}).
• When the Administrator views the settings page, the browser should execute the alert(document.domain) payload.
• The HTML source of the settings page should show the payload breaking out of an attribute: <input ... value=""><script>alert(document.domain)</script>" ...>.

8. Verification Steps

1. Database Check: Use WP-CLI to verify the stored option:
   wp option get lae_settings --format=json
   Check if the injected string is present in the output.
2. Response Check: Verify the http_request response for the AJAX call contains a successful status code and JSON body.
3. Visual Confirmation: Use browser_navigate as an Admin to the settings page and use browser_eval to check for the existence of the injected script or the alert.

9. Alternative Approaches

• Payload Variations: If " is filtered, try ' or a tag-based breakout: </label><script>alert(1)</script>.
• Different Settings: The description mentions "multiple checkbox settings." If one field is sanitized, try others (e.g., settings for specific Elementor widgets like "Accordion" or "Post Grid").
• Nonce Action Guessing: If the settings page is unreachable even with improper AC, check the frontend source code. Sometimes admin-ajax nonces are inadvertently leaked on the frontend if the plugin shares logic between contexts. Look for lae_ prefixed variables in the browser console.