Exploitation Research Plan - CVE-2025-68018

1. Vulnerability Summary

The Order Notification for WooCommerce plugin (versions <= 3.6.1) is vulnerable to Missing Authorization due to the use of an insecure version of the WP-Dev-Kit (WPDK) SDK.

Specifically, the WPDK\Client class (included in the plugin) registers a function manage_permanent_dismissible to the admin_init hook. In WordPress, admin_init is triggered for any request to /wp-admin/admin-ajax.php, regardless of whether the user is authenticated. The manage_permanent_dismissible function fails to perform any capability checks or nonce validations before calling update_option(). This allows an unauthenticated attacker to overwrite arbitrary WordPress options with a numeric timestamp, leading to unauthorized configuration changes (e.g., enabling user registration).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• HTTP Method: GET
• Parameters:
  • pb_action: Must be set to permanent_dismissible to trigger the vulnerable code path.
  • id: The name of the WordPress option to overwrite (e.g., users_can_register).
• Authentication: None required (unauthenticated).
• Preconditions: The plugin must be active.

3. Code Flow

1. Entry Point: An HTTP request is sent to admin-ajax.php. This triggers the admin_init hook.
2. Hook Registration: In includes/wp-dev-kit/classes/class-client.php, the __construct method registers the hook:

   add_action( 'admin_init', array( $this, 'manage_permanent_dismissible' ) );
   

3. Vulnerable Function: The manage_permanent_dismissible function executes:

   function manage_permanent_dismissible() {
       $query_args = wp_unslash( array_map( 'sanitize_text_field', $_GET ) );
       if ( Utils::get_args_option( 'pb_action', $query_args ) == 'permanent_dismissible' && ! empty( $id = Utils::get_args_option( 'id', $query_args ) ) ) {
           // Overwrites the option named in 'id' with the current timestamp
           update_option( $this->get_notices_id( $id ), time() );
           // Redirects to wp-admin
           wp_safe_redirect( site_url( 'wp-admin' ) );
           exit;
       }
   }
   

4. Option Key Generation: The function calls get_notices_id($id), which returns $this->integration_server . $id. In this plugin's configuration, $this->integration_server defaults to an empty string '' (see includes/wp-dev-kit/classes/class-client.php:73). Therefore, the id parameter directly controls the option key passed to update_option.
5. Sink: update_option($id, time()) is executed without authorization checks.

4. Nonce Acquisition Strategy

This vulnerability does not require a nonce. The manage_permanent_dismissible function in class-client.php lacks any calls to check_admin_referer, check_ajax_referer, or wp_verify_nonce.

5. Exploitation Strategy

We will exploit this to enable public user registration on the site by overwriting the users_can_register option.

Step 1: Trigger Option Overwrite

Send a GET request to the vulnerable endpoint targeting the users_can_register option.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Query Parameters:
  • pb_action=permanent_dismissible
  • id=users_can_register

Step 2: Verification

Check if the option value has changed from 0 (disabled) to a large integer (the timestamp), which WordPress evaluates as true.

6. Test Data Setup

1