[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_CVIEY1hHzAvTY8KiQAAXBvMYoKWDSkGhVa00rVMa6Q":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":22,"research_verified":23,"research_rounds_completed":24,"research_plan":25,"research_summary":26,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":27,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":23,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":23,"source_links":31},"CVE-2026-39713","mailercloud-integrate-webforms-and-synchronize-website-contacts-missing-authorization","Mailercloud – Integrate webforms and synchronize website contacts \u003C= 1.0.7 - Missing Authorization","The Mailercloud – Integrate webforms and synchronize website contacts plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.0.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.","mailercloud-integrate-webforms-synchronize-contacts",null,"\u003C=1.0.7","1.0.8","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-03-02 00:00:00","2026-05-26 18:19:07",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F7728b8d3-5f85-4411-968a-2239c05273d8?source=api-prod",86,[],"researched",false,3,"Since the source code for version 1.0.7 of the **Mailercloud – Integrate webforms and synchronize website contacts** plugin is not provided, this research plan is based on the vulnerability description, CVSS vector (AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N), and common patterns in WordPress \"Missing Authorization\" vulnerabilities.\n\nThe vulnerability involves an unauthenticated user (PR:N) performing an unauthorized action (Integrity: Low). This typically points to an AJAX handler or an `admin_init`\u002F`init` hook that processes data without a `current_user_can()` check.\n\n### 1. Vulnerability Summary\nThe Mailercloud plugin (up to 1.0.7) fails to implement authorization checks on certain functions accessible via WordPress hooks. Specifically, it likely exposes a functionality intended for administrators—such as updating plugin settings, API keys, or synchronization parameters—to unauthenticated users by registering a `wp_ajax_nopriv_` handler or an `admin_init` handler that lacks capability verification.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `http:\u002F\u002F\u003Ctarget>\u002Fwp-admin\u002Fadmin-ajax.php` (for AJAX) or any page (for `admin_init`\u002F`init`).\n*   **Action (Inferred):** Likely related to `mc_save_settings`, `mc_api_key_save`, or `mc_sync_contacts`.\n*   **Method:** HTTP POST request.\n*   **Authentication:** None required (unauthenticated).\n*   **Preconditions:** The plugin must be active.\n\n### 3. Code Flow (Inferred)\n1.  The plugin registers an action via `add_action( 'wp_ajax_nopriv_[action_name]', 'function_name' )` or `add_action( 'admin_init', 'function_name' )`.\n2.  The `function_name` callback is triggered.\n3.  The callback processes user-supplied data from `$_POST` or `$_GET`.\n4.  **Security Failure:** The function performs sensitive operations (e.g., `update_option()`) without calling `current_user_can( 'manage_options' )`.\n5.  **Security Failure:** The function may also lack a nonce check (`check_ajax_referer` or `wp_verify_nonce`).\n\n### 4. Nonce Acquisition Strategy\nIf the vulnerable function uses `check_ajax_referer` or `check_admin_referer` but lacks authorization, a nonce must be obtained.\n\n1.  **Search for Nonce Creation:** Search for `wp_create_nonce` in the plugin code to identify where the nonce is generated.\n2.  **Locate Localized Scripts:** Look for `wp_localize_script` to see if the nonce is passed to the frontend.\n3.  **Shortcode Identification:** Identify any shortcodes (e.g., `[mailercloud_form]`) that might enqueue the script containing the nonce.\n4.  **Creation & Navigation:**\n    *   Create a test page: `wp post create --post_type=page --post_status=publish --post_content='[SHORTCODE_FOUND]'`.\n    *   Navigate to the page using `browser_navigate`.\n    *   Extract the nonce using `browser_eval`: `browser_eval(\"window.mc_ajax_obj?.nonce\")` (Replace `mc_ajax_obj` and `nonce` with the actual keys found in the source).\n\n*Note: If the vulnerability is a total lack of security, no nonce will be required.*\n\n### 5. Exploitation Strategy\nThe agent should follow these steps to identify and exploit the specific sink:\n\n#### Step 1: Discovery\nSearch the plugin directory for vulnerable registration patterns:\n```bash\ngrep -rn \"wp_ajax_nopriv_\" .\ngrep -rn \"admin_init\" .\n```\nFor each identified function, check for `current_user_can`. The function that lacks this check and performs an `update_option` or `wpdb->query` is the target.\n\n#### Step 2: Target Identification (Example)\nAssume the found action is `mc_save_api_key`.\n*   **Vulnerable File:** `includes\u002Fclass-mailercloud-settings.php` (Example)\n*   **Vulnerable Function:** `save_settings` (Example)\n*   **Parameters:** `api_key`, `list_id`.\n\n#### Step 3: Execution (Unauthenticated Setting Update)\nIf the vulnerability allows updating the API key, the exploit would look like this:\n\n**HTTP Request:**\n```http\nPOST \u002Fwp-admin\u002Fadmin-ajax.php HTTP\u002F1.1\nHost: \u003Ctarget>\nContent-Type: application\u002Fx-www-form-urlencoded\n\naction=mc_save_api_key&api_key=pwned_key_1337&nonce=[EXTRACTED_NONCE]\n```\n\n### 6. Test Data Setup\n1.  Install and activate the plugin.\n2.  (Optional) Set a valid-looking API key via WP-CLI to provide a baseline: `wp option update mailercloud_api_key \"original_key_12345\"`.\n3.  If the plugin requires a form to be present for nonce generation, identify the shortcode via `grep -r \"add_shortcode\" .`.\n\n### 7. Expected Results\n*   The server returns a `200 OK` or a JSON success message (e.g., `{\"success\":true}`).\n*   The targeted setting (e.g., `mailercloud_api_key`) is modified in the database despite the request being unauthenticated.\n\n### 8. Verification Steps\nAfter sending the exploit request, verify the state change using WP-CLI:\n```bash\n# Verify if the option was changed\nwp option get mailercloud_api_key\n```\nA successful exploit will show the value `pwned_key_1337`.\n\n### 9. Alternative Approaches\n*   **admin_init Bypass:** If the function is hooked to `admin_init`, it can often be triggered by any request to `\u002Fwp-admin\u002Fadmin-post.php` or even the frontend if the plugin doesn't restrict `admin_init` to the dashboard context.\n*   **Sync Trigger:** If setting updates are not possible, check for actions like `mc_sync_contacts` which might allow an attacker to trigger resource-intensive synchronization processes, leading to potential Denial of Service (DoS) or unauthorized data transmission to a third-party API.\n*   **Field Mapping Manipulation:** Look for actions that save \"field mappings.\" An attacker might change these to redirect user-submitted form data to incorrect Mailercloud attributes.","The Mailercloud – Integrate webforms and synchronize website contacts plugin for WordPress is vulnerable to unauthorized access in versions up to and including 1.0.7. This vulnerability stems from missing capability checks on sensitive functions, enabling unauthenticated attackers to perform unauthorized actions such as updating plugin configurations.","1. Identify a vulnerable AJAX action (e.g., one registered with `wp_ajax_nopriv_`) or an `admin_init` hook that lacks a `current_user_can()` check.\n2. Access a public page or post containing the plugin's shortcode to extract any required nonces from the localized JavaScript objects.\n3. Construct a POST request to `\u002Fwp-admin\u002Fadmin-ajax.php` containing the `action` parameter and the specific settings to be modified (e.g., API keys).\n4. Execute the request unauthenticated to overwrite the plugin's options in the database.","gemini-3-flash-preview","2026-04-18 22:05:57","2026-04-18 22:06:17",{"type":32,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":33},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmailercloud-integrate-webforms-synchronize-contacts\u002Ftags"]