Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription

This research plan focuses on exploiting a Cross-Site Request Forgery (CSRF) vulnerability in the Newsletter plugin (<= 9.1.0). The vulnerability resides in the hook_newsletter_action() function, which processes newsletter-related actions like unsubscription without sufficient nonce validation.

---

1. Vulnerability Summary

• Vulnerability: Cross-Site Request Forgery (CSRF)
• Location: newsletter/includes/newsletter.php (or similar core file where hook_newsletter_action is defined).
• Cause: The plugin registers a hook (typically on init or wp_loaded) called hook_newsletter_action. This function parses the na (Newsletter Action) parameter from the request. When na is set to u (unsubscribe), it processes the unsubscription logic. In affected versions, this logic lacks a valid WordPress nonce check, allowing an attacker to trigger the unsubscription of any subscriber if they can guess or obtain that subscriber's unique key (nk).

2. Attack Vector Analysis

• Endpoint: The WordPress frontend (any URL, but typically the root /).
• Hook: init or wp_loaded.
• Action Parameter: na=u (triggers the unsubscription flow).
• Identity Parameter: nk (Newsletter Key - a unique hash for each subscriber).
• Authentication: Unauthenticated.
• Preconditions: The attacker must know the subscriber's unique key (nk). While this is a secret token, the vulnerability is a CSRF because if a user (subscriber) clicks a malicious link or visits a page with a hidden request to /?na=u&nk=[user_key], the plugin will process the unsubscription without confirming the user's intent via a nonce.

3. Code Flow

1. Entry Point: Newsletter::hook_newsletter_action() is called during the WordPress init cycle.
2. Action Identification: The function checks $_REQUEST['na']. If $_REQUEST['na'] == 'u', it enters the unsubscription logic.
3. Subscriber Identification: It retrieves the subscriber using $_REQUEST['nk'].
4. Vulnerable Point: The code proceeds to update the subscriber status in the database (typically to 'U' for unsubscribed) without calling wp_verify_nonce() or check_admin_referer().
5. Sink: The database is updated via $wpdb->update on the {prefix}newsletter table.

4. Nonce Acquisition Strategy

According to the vulnerability description, this is a missing or incorrect nonce validation.

• If the validation is missing: No nonce is required. The exploit can be sent as a direct request.
• If the validation is incorrect (e.g., checking a nonce that is never generated or using a weak check): The exploit will likely succeed by simply omitting the nonce or providing a dummy value.

Since the goal is unauthenticated CSRF against a subscriber action, and these actions are intended to be performed via email links (which traditionally use the nk token instead of WP nonces), the vulnerability likely stems from the plugin failing to implement a "Confirm Unsubscribe" page that uses a WP nonce to verify the action was intentional when triggered via the web.

5. Exploitation Strategy

1. Preparation: Identify a target subscriber's nk key.
2. Attack: Use http_request to simulate a victim's browser being forced to visit the unsubscription URL.
3. Request Details:
   • Method: GET (most common for link-based unsubscription) or POST.
   • URL: http://localhost:8080/?na=u&nk=[SUBSCRIBER_NK]
   • Headers: Content-Type: application/x-www-form-urlencoded
4. Redirection: The plugin usually redirects to a "Goodbye" page or a confirmation message.

6. Test Data Setup

To demonstrate the vulnerability, we must first create a subscriber and extract their secret key.

1. Create Subscriber:

   wp eval "NewsletterSubscription::instance()->subscribe(['email'=>'victim@example.com', 'status'=>'C']);"
   

2. Extract NK:

   # Get the 'nk' (access key) for the created email
   NK=$(wp db query "SELECT token FROM wp_newsletter WHERE email='victim@example.com'" --skip-column-names)
   echo $NK
   

3. Check Initial Status:

   wp db query "SELECT status FROM wp_newsletter WHERE email='victim@example.com'"
   

7. Expected Results

• The http_request should return a 200 OK or a 302 Redirect.
• The subscriber status for victim@example.com in the wp_newsletter table should change from 'C' (Confirmed) to 'U' (Unsubscribed).
• No "Invalid Nonce" or "Security Check Failed" error should appear.

8. Verification Steps

After executing the exploit, verify the database state using WP-CLI:

# The status should be 'U'
wp db query "SELECT email, status FROM wp_newsletter WHERE email='victim@example.com'"

9. Alternative Approaches

If the nk parameter alone is not enough, the plugin might require an ni (Subscriber ID) parameter as well.

• Alternative URL: /?na=u&nk=[NK]&ni=[ID]
• Extraction:

  ID=$(wp db query "SELECT id FROM wp_newsletter WHERE email='victim@example.com'" --skip-column-names)
  

If the plugin implements a partial check, try adding a fake nonce:

• /?na=u&nk=[NK]&_wpnonce=1234567890

If the action is handled via admin-ajax.php (less likely for unsubscription links but possible):

• Action: newsletter
• Data: action=newsletter&na=u&nk=[NK]