Research Plan: CVE-2026-7544 Information Exposure in Mux Video Uploader

1. Vulnerability Summary

The Mux Video Uploader plugin (versions <= 1.1.4) is vulnerable to Sensitive Information Exposure. The plugin enqueues a settings script via the function muxvideo_enqueue_settings_script (likely hooked to admin_enqueue_scripts) and uses wp_localize_script to pass the Mux API credentials from the server to the client-side JavaScript.

Because this enqueuing and localization process lacks proper capability checks (e.g., current_user_can('manage_options')), any authenticated user with access to the WordPress admin dashboard—including low-privileged Subscribers—can view the page source and extract the decrypted tokenId and tokenSecret from the MuxVideoSettings JavaScript object.

2. Attack Vector Analysis

• Endpoint: Any WordPress admin page accessible to a Subscriber, typically /wp-admin/profile.php or /wp-admin/index.php.
• Authentication: Required (Subscriber level or higher).
• Vulnerable Variable: The global JavaScript object MuxVideoSettings localized into the page HTML.
• Sensitive Data:
  • MuxVideoSettings.tokenId (Mux API Token ID)
  • MuxVideoSettings.tokenSecret (Mux API Token Secret)

3. Code Flow

1. The plugin registers a function muxvideo_enqueue_settings_script to the admin_enqueue_scripts hook.
2. Inside this function, it retrieves the plugin options using get_option('muxvideo_options').
3. The credentials muxvideo_token_id and muxvideo_token_secret are decrypted using mux_maybe_decrypt() (found in includes/functions.php, line 148).
4. The decrypted credentials are passed to wp_localize_script to be used by assets/js/settings.js.
5. As shown in assets/js/settings.js (lines 5-6):

   let idValue = MuxVideoSettings.tokenId;
   let secretValue = MuxVideoSettings.tokenSecret;
   

6. A Subscriber user logs into /wp-admin/. WordPress executes all functions hooked to admin_enqueue_scripts.
7. The server responds with HTML containing a <script> block that defines MuxVideoSettings with the plain-text credentials.

4. Nonce Acquisition Strategy

While the information exposure itself does not require a nonce (it is a GET-based leak of data into the DOM), subsequent actions (like using the Mux API via the plugin's AJAX handlers) would require the mux_token_nonce.

The source code suggests that mux_token_nonce is likely also localized into the same or a similar object. Based on includes/functions-wp_ajax.php, the AJAX handlers look for a nonce named mux_token_nonce.

To extract the credentials and the nonce:

1. Navigate to /wp-admin/profile.php as a Subscriber.
2. Use browser_eval to extract the values from the global JS scope.

5. Exploitation Strategy

1. Preparation:
   • Log in as an Administrator.
   • Configure the plugin with dummy Mux API credentials (UUID for ID, 75 chars for Secret).
2. Access as Attacker:
   • Log in as a Subscriber user.
   • Navigate to /wp-admin/profile.php.
3. Data Extraction:
   • Check if the MuxVideoSettings object exists in the global window scope.
   • Extract tokenId and tokenSecret.
4. Proof of Concept:
   • Output the extracted credentials to demonstrate exposure.

6. Test Data Setup

1. Mux Options:
   Use WP-CLI to set validly-formatted dummy credentials so the plugin processes them:

   # Token ID: UUID format
   # Token Secret: 75 characters
   wp option update muxvideo_options '{"muxvideo_token_id":"decafbad-1337-4444-8888-1234567890ab", "muxvideo_token_secret":"this_is_a_very_long_secret_exactly_75_characters_long_for_validation_test_12"}' --format=json
   

   Note: The plugin's muxvideo_handle_option_update hook will automatically encrypt these when saved via update_option.
2. Attacker User:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
   

7. Expected Results

The Subscriber user, despite having no administrative privileges, will be able to retrieve the following via the browser console or page source:

• MuxVideoSettings.tokenId == "decafbad-1337-4444-8888-1234567890ab"
• MuxVideoSettings.tokenSecret == "this_is_a_very_long_secret_exactly_75_characters_long_for_validation_test_12"

8. Verification Steps

1. HTTP Request:
   Use http_request as the Subscriber to GET /wp-admin/profile.php.
2. Regex Search:
   Search the response body for:
   "tokenId":"decafbad-1337-4444-8888-1234567890ab"
"tokenSecret":"this_is_a_very_long_secret_exactly_75_characters_long_for_validation_test_12"
3. JavaScript Execution:
   Use browser_eval("window.MuxVideoSettings") and verify the returned JSON object contains the sensitive keys.

9. Alternative Approaches

If the script is only enqueued on specific admin pages (though the ID suggests a general enqueue), check:

1. /wp-admin/admin.php?page=mux-video-settings (The plugin might fail to check capabilities on the settings page registration itself, allowing Subscribers to visit the URL).
2. Check for the object on the "Add New Post" page if the Mux Gutenberg block enqueues the same settings script. Based on the file name assets/js/settings.js, it is highly likely intended for the settings page but erroneously enqueued globally in the admin area.