Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 1.1.1 - Unauthenticated PHP Object Injection

Based on the vulnerability details for CVE-2026-25429, this is a classic Unauthenticated PHP Object Injection vulnerability in the "Nexa Blocks" plugin. Since source files are not provided, this plan is constructed based on the patch description, common Gutenberg plugin patterns, and WordPress security best practices.

---

1. Vulnerability Summary

The Nexa Blocks plugin (versions <= 1.1.1) fails to properly validate user-supplied data before passing it to the PHP unserialize() function. This occurs in an endpoint accessible to unauthenticated users (likely an AJAX nopriv handler or an early-loading hook). An attacker can submit a crafted, serialized PHP object string. If a suitable Property-Oriented Programming (POP) chain exists in the WordPress environment (in core, other plugins, or the theme), this can lead to Remote Code Execution (RCE), arbitrary file deletion, or sensitive data retrieval.

2. Attack Vector Analysis

• Endpoint: Likely wp-admin/admin-ajax.php.
• Action (Inferred): Look for AJAX actions registered with wp_ajax_nopriv_. Potential candidates: nexa_blocks_get_remote_data, nexa_import_template, or nexa_save_block_attributes.
• Vulnerable Parameter: Likely a POST parameter named settings, data, attributes, or config.
• Authentication: Unauthenticated (nopriv).
• Preconditions: A valid WordPress nonce may be required if the developer attempted CSRF protection, but the description suggests the endpoint is accessible to unauthenticated users.

3. Code Flow (Inferred)

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with a specific action.
2. Hook Registration: The plugin registers the action:
   add_action( 'wp_ajax_nopriv_[ACTION_NAME]', 'callback_function' );
3. Vulnerable Sink: Inside the callback function, the plugin retrieves a parameter from $_POST or $_REQUEST.
4. Deserialization: The code executes:
   $unserialized_data = unserialize( base64_decode( $_POST['[PARAMETER]'] ) );
   Or
   $unserialized_data = maybe_unserialize( $_POST['[PARAMETER]'] );
5. Execution: The PHP engine instantiates the object, triggering magic methods like __wakeup() or __destruct().

4. Nonce Acquisition Strategy

If the endpoint requires a nonce (common in AJAX handlers), the plugin likely exposes it via wp_localize_script.

1. Identify Trigger: Search the plugin code for wp_create_nonce. Note the action string (e.g., 'nexa_blocks_nonce').
2. Locate Localization: Find where this nonce is passed to the frontend (e.g., wp_localize_script( 'nexa-script', 'nexa_params', ... )).
3. Create Test Page:
   • Find a shortcode or block registered by the plugin (e.g., [nexa_block]).
   • Execute: wp post create --post_type=page --post_status=publish --post_title="Nexa Test" --post_content='[nexa_block]'
4. Extract via Browser:
   • Navigate to the newly created page.
   • Use browser_eval to extract the nonce:
     browser_eval("window.nexa_params?.nonce") (Replace nexa_params and nonce with actual keys found in the code).

5. Exploitation Strategy

To prove Object Injection without a complex POP chain, we will use a "Payload of Confirmation"—an object that triggers a visible change or error without requiring external dependencies.

Step 1: Identify the Endpoint and Parameter
Use grep on the plugin directory to find the sink:
grep -rn "unserialize" .
Look for matches where the input comes from $_POST or $_GET.

Step 2: Craft the Payload
If no complex POP chain is available, use a core WordPress class to trigger a file system check (which proves the object was instantiated).
Example Payload (Base64 encoded):
O:8:"WP_Theme":1:{s:12:"theme_exists";b:1;}
(This is a safe way to test if unserialize is reached).

Step 3: Construct the HTTP Request
Using the http_request tool:

• Method: POST
• URL: http://[TARGET]/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: action=[ACTION_NAME]&nonce=[NONCE]&[PARAMETER]=[PAYLOAD]

6. Test Data Setup

1. Plugin Installation: Ensure Nexa Blocks <= 1.1.1 is installed and active.
2. Shortcode Page: Create a page containing a Nexa Block to ensure all scripts and nonces are loaded.
   wp post create --post_type=page --post_status=publish --post_content='<!-- wp:nexa/block-name /-->' --post_title='Exploit Test'
3. Identify Nonce Key: Audit wp_localize_script calls in the plugin's includes/ or admin/ files to find the JS variable name.

7. Expected Results

• Success Indicator: The server responds with a 200 OK or a specific plugin error message, but the PHP error log (if enabled) might show "Attempt to assign property of non-object" or similar errors related to the injected object if the plugin expects an array.
• Proof of Injection: If a POP chain is used (e.g., GuzzleHttp\Cookie\FileCookieJar), a file will be created/deleted on the system.
• Blind Verification: If the injection is blind, use a payload that triggers a time delay (e.g., a hypothetical chain involving sleep()).

8. Verification Steps

After sending the exploit request, verify the injection:

1. Check PHP Error Logs: Look for serialization errors or class instantiation logs.
   tail -f /var/www/html/wp-content/debug.log
2. WP-CLI Check: If the payload was designed to modify an option or user:
   wp option get [injected_option_name]
3. Monitor Filesystem: If using a file-delete/write chain, check the target directory.

9. Alternative Approaches

• REST API: Check if the vulnerability exists in a REST route:
  grep -rn "register_rest_route" .
  Look for routes where the permission_callback is __return_true and parameters are passed to unserialize.
• Maybe_unserialize: Developers often use maybe_unserialize(). This function only unserializes if the string looks like a serialized object. It is just as dangerous if the input is user-controlled.
• Cookie-based: Some page builders store configuration in cookies. Check $_COOKIE processing in init hooks.

---

Key Identifiers to Search for (Inferred):

• Action Name: nexa_get_template, nexa_blocks_action, nexa_ajax_handler
• JS Variables: nexa_blocks_vars, nexa_ajax_obj
• Parameter: data, attributes, settings_data