[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-tKeczoB6H6PBMFiy1WqXUsUj_9FxHUTX5mDuLLnwgI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":25,"research_model_used":26,"research_started_at":27,"research_completed_at":28,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":29},"CVE-2026-57758","permalink-manager-for-woocommerce-cross-site-request-forgery","Permalink Manager for WooCommerce \u003C= 1.0.8.2 - Cross-Site Request Forgery","The Permalink Manager for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","permalink-manager-for-woocommerce",null,"\u003C=1.0.8.2","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Cross-Site Request Forgery (CSRF)","2026-07-02 00:00:00","2026-07-07 19:55:55",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F61d32d2e-1ca0-4a45-8c4d-b6584c2e7c9e?source=api-prod",[],"researched",false,3,"This research plan outlines the process for analyzing and exploiting **CVE-2026-57758**, a Cross-Site Request Forgery (CSRF) vulnerability in the **Permalink Manager for WooCommerce** plugin.\n\n### 1. Vulnerability Summary\nThe Permalink Manager for WooCommerce plugin fails to perform adequate nonce validation on functions that modify plugin settings or permalink structures. Because these actions lack CSRF protection (`check_admin_referer` or `check_ajax_referer`), an attacker can craft a malicious request. If a logged-in administrator visits a site controlled by the attacker, the administrator's browser will execute the request with their high-level privileges, leading to unauthorized configuration changes.\n\n### 2. Attack Vector Analysis\n*   **Target Endpoint:** `wp-admin\u002Fadmin-post.php` or `wp-admin\u002Fadmin-ajax.php`.\n*   **Vulnerable Action:** Likely a settings-save or bulk-update action (e.g., `pm_save_settings` or `pm_update_permalinks` - *inferred*).\n*   **Authentication Level:** Requires an **Administrator** session.\n*   **Preconditions:** The attacker must trick the administrator into clicking a link or visiting a page that auto-submits a POST request to the target WordPress site.\n*   **Impact:** Modification of WooCommerce permalink structures, potentially breaking SEO, causing 404 errors, or redirecting product traffic to malicious locations if redirect settings are included.\n\n### 3. Code Flow (Research Path)\nSince source files were not provided, the following steps must be taken to identify the exact sink:\n\n1.  **Identify State-Changing Hooks:** Search the plugin directory for hooks that handle form submissions or AJAX requests:\n    ```bash\n    grep -rE \"admin_post_|wp_ajax_\" \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fplugins\u002Fpermalink-manager-for-woocommerce\u002F\n    ```\n2.  **Locate the Handler:** Find the function associated with these hooks. Common patterns in this plugin include functions that update options or post meta.\n3.  **Audit for Nonces:** Inspect the identified handler function (e.g., `save_settings` or `ajax_update_uri`). Look for the **absence** of:\n    *   `check_admin_referer( 'action_name', 'nonce_name' );`\n    *   `check_ajax_referer( 'action_name', 'nonce_name' );`\n    *   `wp_verify_nonce( $_REQUEST['nonce'], 'action_name' );`\n4.  **Confirm Sink:** Verify the function calls `update_option()` or modifies the `$wpdb` without further authorization checks.\n\n### 4. Nonce Acquisition Strategy\nIf the vulnerability is a **missing** nonce check, no nonce is required for exploitation.\n\nIf the vulnerability is an **incorrect** nonce check (e.g., the plugin checks a nonce that is exposed to unauthenticated users), use the following strategy:\n1.  **Find Exposed Nonces:** Search the code for where nonces are created:\n    ```bash\n    grep -r \"wp_create_nonce\" \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fplugins\u002Fpermalink-manager-for-woocommerce\u002F\n    ```\n2.  **Determine Visibility:** If `wp_create_nonce` is called in a function hooked to `wp_head` or `wp_enqueue_scripts`, it is likely localized into a JS variable.\n3.  **Extraction:**\n    *   Navigate to the WordPress homepage or a product page using `browser_navigate`.\n    *   Execute `browser_eval(\"window.permalink_manager_data?.nonce\")` (inferred variable name) to extract the token.\n\n### 5. Exploitation Strategy\nAssuming the vulnerability lies in the settings save functionality (common for this CVE type):\n\n**Step 1: Identify Parameters**\nFind the POST parameters used to save settings. This is typically done by inspecting the HTML form in the plugin's admin page:\n*   `action`: (e.g., `pm_save_settings`)\n*   `permalink-manager-settings[setting_name]`: (The actual configuration values)\n\n**Step 2: Construct the Exploit (PoC)**\nUsing the `http_request` tool, simulate a CSRF attack. In a real-world scenario, this would be an auto-submitting HTML form on an attacker's site.\n\n*   **URL:** `https:\u002F\u002F[target-site]\u002Fwp-admin\u002Fadmin-post.php`\n*   **Method:** `POST`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body:**\n    ```\n    action=pm_save_settings&pm_settings[disable_permalinks]=1&pm_settings[extra_redirects]=1\n    ```\n    *(Parameters are examples; replace with real keys found during Step 3.1)*\n\n### 6. Test Data Setup\n1.  **Install Plugin:** Ensure `permalink-manager-for-woocommerce` version 1.0.8.2 is active.\n2.  **Create Content:** Use WP-CLI to create a test product:\n    ```bash\n    wp wc product create --name=\"Test Product\" --type=\"simple\" --user=admin\n    ```\n3.  **Configure Admin:** Log in as an administrator to ensure the session is active for the \"victim\" browser context.\n\n### 7. Expected Results\n*   The `http_request` should return a `302 Found` (redirecting back to the settings page) or a `200 OK`.\n*   The plugin settings in the database should be updated to the values provided in the malicious POST body.\n\n### 8. Verification Steps\nAfter the exploit, verify the state change via WP-CLI:\n```bash\n# Check if the plugin options have changed\nwp option get permalink-manager-settings\n\n# Check if a specific URI has been modified in post meta\nwp post meta list [PRODUCT_ID] --keys=_custom_uri\n```\n\n### 9. Alternative Approaches\n*   **AJAX Endpoint:** If the vulnerability exists in a `wp_ajax_` hook instead of `admin_post`, the target URL changes to `wp-admin\u002Fadmin-ajax.php`. The `Content-Type` remains `application\u002Fx-www-form-urlencoded`, and the `action` parameter remains mandatory.\n*   **Permalinks Reset:** If the plugin has a \"Reset Permalinks\" button that is unprotected, the exploit can be used to wipe all custom URIs on the site, causing widespread 404 errors. Search for action strings like `pm_reset_uris` or `pm_repair_permalinks`.","The Permalink Manager for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.0.8.2. This is due to missing or incorrect nonce validation on administrative functions, allowing unauthenticated attackers to perform unauthorized actions, such as modifying plugin settings or permalink structures, via forged requests.","The exploit targets administrative handlers typically reached via `wp-admin\u002Fadmin-post.php` or `wp-admin\u002Fadmin-ajax.php`. An attacker crafts a malicious request (often as an auto-submitting HTML form) containing a state-changing action such as `pm_save_settings` or `pm_update_permalinks`. The payload includes parameters to overwrite plugin configurations or modify post meta (e.g., custom URIs). For the attack to succeed, a site administrator with an active session must be tricked into clicking a link or visiting a page that triggers the forged POST request. Since the plugin lacks nonce validation (e.g., `check_admin_referer`), the server executes the request as the administrator.","gemini-3-flash-preview","2026-07-25 10:58:23","2026-07-25 10:59:00",{"type":30,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":31},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpermalink-manager-for-woocommerce\u002Ftags"]