Nelio Popups <= 1.3.5 - Missing Authorization

This research plan outlines the investigation and exploitation of CVE-2026-25016, a Missing Authorization vulnerability in the Nelio Popups plugin (<= 1.3.5).

---

1. Vulnerability Summary

The Nelio Popups plugin registers several AJAX handlers that perform administrative actions (such as duplicating popups or updating settings). The vulnerability exists because certain handlers fail to perform a current_user_can() check or verify that the user has sufficient privileges to manipulate specific posts. This allows a user with Contributor-level access or higher to perform actions intended for Authors or Administrators.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: nelio_popups_duplicate_popup (Inferred based on common "Missing Authorization" patterns in this plugin).
• Authentication: Required (Contributor role or higher).
• Parameters:
  • action: nelio_popups_duplicate_popup
  • post_id: The ID of the popup to duplicate.
  • _wpnonce: A security nonce.
• Precondition: The attacker must be logged in as a Contributor.

3. Code Flow (Inferred)

1. Registration: In includes/class-nelio-popups-admin.php (or similar), the plugin registers the AJAX action:
   add_action( 'wp_ajax_nelio_popups_duplicate_popup', array( $this, 'ajax_duplicate_popup' ) );
2. Entry Point: The function ajax_duplicate_popup() is triggered via admin-ajax.php.
3. Missing Check: The function likely checks the nonce using check_ajax_referer but fails to call current_user_can( 'edit_others_posts' ) or current_user_can( 'manage_options' ).
4. Execution: The code proceeds to use get_post( $post_id ) and creates a new post based on the retrieved data, effectively allowing a Contributor to duplicate and modify popups they do not own.

4. Nonce Acquisition Strategy

Contributors have access to the WordPress dashboard (/wp-admin/). The Nelio Popups plugin likely localizes a nonce for its admin scripts.

1. Identify Shortcode/Script Loading: Check where the plugin enqueues its admin scripts. Typically, this is on the Popups list page or the Dashboard.
2. Create Test Content: As an admin, create a popup that the Contributor will attempt to duplicate.
3. Navigate and Extract:
   • Login as the Contributor user.
   • Navigate to /wp-admin/edit.php?post_type=nelio_popup (Contributors can usually view the list of posts even if they can't edit others).
   • Use browser_eval to find the localized data.
   • Inferred JS Variable: nelio_popups_admin or nelioPopups.
   • Inferred Nonce Key: nonce or duplicate_popup_nonce.
   • Command: browser_eval("window.nelio_popups_admin?.nonce") or browser_eval("window.nelio_popups_admin?.duplicate_popup_nonce").

5. Exploitation Strategy

The goal is to demonstrate that a Contributor can duplicate a popup created by an Administrator.

Step 1: Discover Post ID
The agent will list existing popups to find a target ID.
wp post list --post_type=nelio_popup

Step 2: Perform Unauthorized Duplication
Using the http_request tool:

• Method: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=nelio_popups_duplicate_popup&post_id=[TARGET_ID]&_wpnonce=[EXTRACTED_NONCE]
  

6. Test Data Setup

1. Install Plugin: Ensure Nelio Popups v1.3.5 is installed and active.
2. Create Admin Popup:
   wp post create --post_type=nelio_popup --post_title="Admin Secret Popup" --post_status=publish --post_author=1
3. Create Contributor User:
   wp user create attacker attacker@example.com --role=contributor --user_pass=password
4. Note IDs: Save the ID of the "Admin Secret Popup".

7. Expected Results

• The admin-ajax.php request should return a success status (e.g., {"success":true,"data":{...}}).
• A new post of type nelio_popup should be created in the database.
• The new post should be a copy of the Admin's popup but potentially assigned to the Contributor or left as a draft, depending on the internal logic of ajax_duplicate_popup.

8. Verification Steps

1. Check Post Count:
   wp post list --post_type=nelio_popup
   Verify that a new popup exists with a title like "Admin Secret Popup (Copy)".
2. Check Ownership/Metadata:
   wp post get [NEW_ID] --format=json
   Verify if the metadata or content matches the original popup.

9. Alternative Approaches

If nelio_popups_duplicate_popup is not the vulnerable action, the agent should search the codebase for other wp_ajax_ hooks lacking capability checks:

grep -rn "add_action.*wp_ajax_" . | grep -v "nopriv"

For each handler found, check the corresponding function for:

1. check_ajax_referer(...) (Existence of nonce)
2. current_user_can(...) (Absence of authorization)

Another potential target: nelio_popups_save_settings. If this action exists and lacks auth, a Contributor could modify global plugin settings.

Payload for Settings Update (Alternative):

action=nelio_popups_save_settings&settings[some_option]=malicious_value&_wpnonce=[NONCE]