[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvnRj45yrJ6SLFpW3kA7obPEAibYm63v4m3wuZnLTCw4":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-7544","mux-video-uploader-authenticated-subscriber-information-exposure","Mux Video Uploader \u003C= 1.1.4 - Authenticated (Subscriber+) Information Exposure","The Mux Video Uploader plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the muxvideo_enqueue_settings_script. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive data including Mux API credentials.","2coders-integration-mux-video",null,"\u003C=1.1.4","1.1.5","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Exposure of Sensitive Information to an Unauthorized Actor","2026-07-10 14:18:37","2026-07-11 02:31:20",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe462a7ba-887c-408d-87a6-9260a33dcff5?source=api-prod",1,[22,23,24,25,26,27,28,29],"CHANGELOG.md","README.txt","assets\u002Fjs\u002Ffunctions.js","assets\u002Fjs\u002Fsettings.js","includes\u002Fdatabase.php","includes\u002Ffunctions-captions.php","includes\u002Ffunctions-wp_ajax.php","includes\u002Ffunctions.php","researched",false,3,"# Research Plan: CVE-2026-7544 Information Exposure in Mux Video Uploader\n\n## 1. Vulnerability Summary\nThe **Mux Video Uploader** plugin (versions \u003C= 1.1.4) is vulnerable to **Sensitive Information Exposure**. The plugin enqueues a settings script via the function `muxvideo_enqueue_settings_script` (likely hooked to `admin_enqueue_scripts`) and uses `wp_localize_script` to pass the Mux API credentials from the server to the client-side JavaScript. \n\nBecause this enqueuing and localization process lacks proper capability checks (e.g., `current_user_can('manage_options')`), any authenticated user with access to the WordPress admin dashboard—including low-privileged **Subscribers**—can view the page source and extract the decrypted `tokenId` and `tokenSecret` from the `MuxVideoSettings` JavaScript object.\n\n## 2. Attack Vector Analysis\n*   **Endpoint**: Any WordPress admin page accessible to a Subscriber, typically `\u002Fwp-admin\u002Fprofile.php` or `\u002Fwp-admin\u002Findex.php`.\n*   **Authentication**: Required (Subscriber level or higher).\n*   **Vulnerable Variable**: The global JavaScript object `MuxVideoSettings` localized into the page HTML.\n*   **Sensitive Data**: \n    *   `MuxVideoSettings.tokenId` (Mux API Token ID)\n    *   `MuxVideoSettings.tokenSecret` (Mux API Token Secret)\n\n## 3. Code Flow\n1.  The plugin registers a function `muxvideo_enqueue_settings_script` to the `admin_enqueue_scripts` hook.\n2.  Inside this function, it retrieves the plugin options using `get_option('muxvideo_options')`.\n3.  The credentials `muxvideo_token_id` and `muxvideo_token_secret` are decrypted using `mux_maybe_decrypt()` (found in `includes\u002Ffunctions.php`, line 148).\n4.  The decrypted credentials are passed to `wp_localize_script` to be used by `assets\u002Fjs\u002Fsettings.js`.\n5.  As shown in `assets\u002Fjs\u002Fsettings.js` (lines 5-6):\n    ```javascript\n    let idValue = MuxVideoSettings.tokenId;\n    let secretValue = MuxVideoSettings.tokenSecret;\n    ```\n6.  A Subscriber user logs into `\u002Fwp-admin\u002F`. WordPress executes all functions hooked to `admin_enqueue_scripts`.\n7.  The server responds with HTML containing a `\u003Cscript>` block that defines `MuxVideoSettings` with the plain-text credentials.\n\n## 4. Nonce Acquisition Strategy\nWhile the information exposure itself does not require a nonce (it is a GET-based leak of data into the DOM), subsequent actions (like using the Mux API via the plugin's AJAX handlers) would require the `mux_token_nonce`.\n\nThe source code suggests that `mux_token_nonce` is likely also localized into the same or a similar object. Based on `includes\u002Ffunctions-wp_ajax.php`, the AJAX handlers look for a nonce named `mux_token_nonce`.\n\nTo extract the credentials and the nonce:\n1.  Navigate to `\u002Fwp-admin\u002Fprofile.php` as a Subscriber.\n2.  Use `browser_eval` to extract the values from the global JS scope.\n\n## 5. Exploitation Strategy\n1.  **Preparation**:\n    *   Log in as an Administrator.\n    *   Configure the plugin with dummy Mux API credentials (UUID for ID, 75 chars for Secret).\n2.  **Access as Attacker**:\n    *   Log in as a Subscriber user.\n    *   Navigate to `\u002Fwp-admin\u002Fprofile.php`.\n3.  **Data Extraction**:\n    *   Check if the `MuxVideoSettings` object exists in the global window scope.\n    *   Extract `tokenId` and `tokenSecret`.\n4.  **Proof of Concept**:\n    *   Output the extracted credentials to demonstrate exposure.\n\n## 6. Test Data Setup\n1.  **Mux Options**:\n    Use WP-CLI to set validly-formatted dummy credentials so the plugin processes them:\n    ```bash\n    # Token ID: UUID format\n    # Token Secret: 75 characters\n    wp option update muxvideo_options '{\"muxvideo_token_id\":\"decafbad-1337-4444-8888-1234567890ab\", \"muxvideo_token_secret\":\"this_is_a_very_long_secret_exactly_75_characters_long_for_validation_test_12\"}' --format=json\n    ```\n    *Note: The plugin's `muxvideo_handle_option_update` hook will automatically encrypt these when saved via `update_option`.*\n2.  **Attacker User**:\n    ```bash\n    wp user create attacker attacker@example.com --role=subscriber --user_pass=password123\n    ```\n\n## 7. Expected Results\nThe Subscriber user, despite having no administrative privileges, will be able to retrieve the following via the browser console or page source:\n*   `MuxVideoSettings.tokenId` == `\"decafbad-1337-4444-8888-1234567890ab\"`\n*   `MuxVideoSettings.tokenSecret` == `\"this_is_a_very_long_secret_exactly_75_characters_long_for_validation_test_12\"`\n\n## 8. Verification Steps\n1.  **HTTP Request**:\n    Use `http_request` as the Subscriber to GET `\u002Fwp-admin\u002Fprofile.php`.\n2.  **Regex Search**:\n    Search the response body for:\n    `\"tokenId\":\"decafbad-1337-4444-8888-1234567890ab\"`\n    `\"tokenSecret\":\"this_is_a_very_long_secret_exactly_75_characters_long_for_validation_test_12\"`\n3.  **JavaScript Execution**:\n    Use `browser_eval(\"window.MuxVideoSettings\")` and verify the returned JSON object contains the sensitive keys.\n\n## 9. Alternative Approaches\nIf the script is only enqueued on specific admin pages (though the ID suggests a general enqueue), check:\n1.  `\u002Fwp-admin\u002Fadmin.php?page=mux-video-settings` (The plugin might fail to check capabilities on the settings page registration itself, allowing Subscribers to visit the URL).\n2.  Check for the object on the \"Add New Post\" page if the Mux Gutenberg block enqueues the same settings script. Based on the file name `assets\u002Fjs\u002Fsettings.js`, it is highly likely intended for the settings page but erroneously enqueued globally in the admin area.","The Mux Video Uploader plugin for WordPress exposes sensitive Mux API credentials to any authenticated user with access to the admin dashboard, including low-privileged Subscribers. This occurs because the plugin enqueues a settings script globally and uses wp_localize_script to output decrypted API keys into a global JavaScript object without verifying that the current user has administrative permissions.","\u002F\u002F assets\u002Fjs\u002Fsettings.js lines 5-6\nlet idValue = MuxVideoSettings.tokenId;\nlet secretValue = MuxVideoSettings.tokenSecret;\n\n---\n\n\u002F\u002F includes\u002Ffunctions.php line 148\nfunction mux_maybe_decrypt(string $value): string {\n    if ($value === '') return '';\n    $dec = mux_crypto_decrypt($value);\n    return $dec !== '' ? $dec : $value;\n}","--- a\u002Fincludes\u002Ffunctions.php\n+++ b\u002Fincludes\u002Ffunctions.php\n@@ -25,6 +25,10 @@\n \n function muxvideo_enqueue_settings_script() {\n+    if (!current_user_can('manage_options')) {\n+        return;\n+    }\n+\n     $options      = get_option('muxvideo_options', []);\n     $token_id     = isset($options['muxvideo_token_id'])     ? mux_maybe_decrypt($options['muxvideo_token_id'])     : '';\n     $token_secret = isset($options['muxvideo_token_secret']) ? mux_maybe_decrypt($options['muxvideo_token_secret']) : '';\n \n     wp_localize_script('muxvideo-settings', 'MuxVideoSettings', [\n         'tokenId'     => $token_id,\n         'tokenSecret' => $token_secret,\n     ]);\n }","The vulnerability is exploited by an authenticated attacker with at least Subscriber-level privileges. Since the plugin enqueues the settings script via the 'admin_enqueue_scripts' hook without capability checks, the attacker simply needs to log in and navigate to any accessible admin page (such as \u002Fwp-admin\u002Fprofile.php). By inspecting the page source or using the browser's developer console, the attacker can view the 'MuxVideoSettings' JavaScript object, which contains the decrypted Mux API tokenId and tokenSecret in plaintext.","gemini-3-flash-preview","2026-07-15 09:26:18","2026-07-15 09:26:41",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.1.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002F2coders-integration-mux-video\u002Ftags\u002F1.1.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002F2coders-integration-mux-video.1.1.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002F2coders-integration-mux-video\u002Ftags\u002F1.1.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002F2coders-integration-mux-video.1.1.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002F2coders-integration-mux-video\u002Ftags"]