Permalink Manager for WooCommerce <= 1.0.8.2 - Cross-Site Request Forgery

This research plan outlines the process for analyzing and exploiting CVE-2026-57758, a Cross-Site Request Forgery (CSRF) vulnerability in the Permalink Manager for WooCommerce plugin.

1. Vulnerability Summary

The Permalink Manager for WooCommerce plugin fails to perform adequate nonce validation on functions that modify plugin settings or permalink structures. Because these actions lack CSRF protection (check_admin_referer or check_ajax_referer), an attacker can craft a malicious request. If a logged-in administrator visits a site controlled by the attacker, the administrator's browser will execute the request with their high-level privileges, leading to unauthorized configuration changes.

2. Attack Vector Analysis

• Target Endpoint: wp-admin/admin-post.php or wp-admin/admin-ajax.php.
• Vulnerable Action: Likely a settings-save or bulk-update action (e.g., pm_save_settings or pm_update_permalinks - inferred).
• Authentication Level: Requires an Administrator session.
• Preconditions: The attacker must trick the administrator into clicking a link or visiting a page that auto-submits a POST request to the target WordPress site.
• Impact: Modification of WooCommerce permalink structures, potentially breaking SEO, causing 404 errors, or redirecting product traffic to malicious locations if redirect settings are included.

3. Code Flow (Research Path)

Since source files were not provided, the following steps must be taken to identify the exact sink:

1. Identify State-Changing Hooks: Search the plugin directory for hooks that handle form submissions or AJAX requests:

   grep -rE "admin_post_|wp_ajax_" /var/www/html/wp-content/plugins/permalink-manager-for-woocommerce/
   

2. Locate the Handler: Find the function associated with these hooks. Common patterns in this plugin include functions that update options or post meta.
3. Audit for Nonces: Inspect the identified handler function (e.g., save_settings or ajax_update_uri). Look for the absence of:
   • check_admin_referer( 'action_name', 'nonce_name' );
   • check_ajax_referer( 'action_name', 'nonce_name' );
   • wp_verify_nonce( $_REQUEST['nonce'], 'action_name' );
4. Confirm Sink: Verify the function calls update_option() or modifies the $wpdb without further authorization checks.

4. Nonce Acquisition Strategy

If the vulnerability is a missing nonce check, no nonce is required for exploitation.

If the vulnerability is an incorrect nonce check (e.g., the plugin checks a nonce that is exposed to unauthenticated users), use the following strategy:

1. Find Exposed Nonces: Search the code for where nonces are created:

   grep -r "wp_create_nonce" /var/www/html/wp-content/plugins/permalink-manager-for-woocommerce/
   

2. Determine Visibility: If wp_create_nonce is called in a function hooked to wp_head or wp_enqueue_scripts, it is likely localized into a JS variable.
3. Extraction:
   • Navigate to the WordPress homepage or a product page using browser_navigate.
   • Execute browser_eval("window.permalink_manager_data?.nonce") (inferred variable name) to extract the token.

5. Exploitation Strategy

Assuming the vulnerability lies in the settings save functionality (common for this CVE type):

Step 1: Identify Parameters
Find the POST parameters used to save settings. This is typically done by inspecting the HTML form in the plugin's admin page:

• action: (e.g., pm_save_settings)
• permalink-manager-settings[setting_name]: (The actual configuration values)

Step 2: Construct the Exploit (PoC)
Using the http_request tool, simulate a CSRF attack. In a real-world scenario, this would be an auto-submitting HTML form on an attacker's site.

• URL: https://[target-site]/wp-admin/admin-post.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=pm_save_settings&pm_settings[disable_permalinks]=1&pm_settings[extra_redirects]=1
  

  (Parameters are examples; replace with real keys found during Step 3.1)

6. Test Data Setup

1. Install Plugin: Ensure permalink-manager-for-woocommerce version 1.0.8.2 is active.
2. Create Content: Use WP-CLI to create a test product:

   wp wc product create --name="Test Product" --type="simple" --user=admin
   

3. Configure Admin: Log in as an administrator to ensure the session is active for the "victim" browser context.

7. Expected Results

• The http_request should return a 302 Found (redirecting back to the settings page) or a 200 OK.
• The plugin settings in the database should be updated to the values provided in the malicious POST body.

8. Verification Steps

After the exploit, verify the state change via WP-CLI:

# Check if the plugin options have changed
wp option get permalink-manager-settings

# Check if a specific URI has been modified in post meta
wp post meta list [PRODUCT_ID] --keys=_custom_uri

9. Alternative Approaches

• AJAX Endpoint: If the vulnerability exists in a wp_ajax_ hook instead of admin_post, the target URL changes to wp-admin/admin-ajax.php. The Content-Type remains application/x-www-form-urlencoded, and the action parameter remains mandatory.
• Permalinks Reset: If the plugin has a "Reset Permalinks" button that is unprotected, the exploit can be used to wipe all custom URIs on the site, causing widespread 404 errors. Search for action strings like pm_reset_uris or pm_repair_permalinks.