Exploitation Research Plan - CVE-2026-25422 (Popularis Extra)

1. Vulnerability Summary

The Popularis Extra plugin (up to and including version 1.2.10) is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability exists because an AJAX handler responsible for a state-changing action—specifically dismissing administrative notices or similar UI elements—fails to implement or correctly validate a WordPress nonce. This allows an unauthenticated attacker to trick a logged-in administrator into performing an action (like permanently dismissing important site notifications) by visiting a malicious webpage.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: popularis_extra_dismiss_notice (inferred based on CVSS 4.3 and common plugin patterns)
• HTTP Method: POST
• Required Parameters:
  • action: popularis_extra_dismiss_notice
  • notice_id: The identifier of the notice to be dismissed (e.g., review_notice, install_notice).
• Authentication: Requires an active session of a user with administrative privileges (capable of seeing/dismissing notices), but can be triggered cross-site via the victim's browser.

3. Code Flow (Inferred)

1. Hook Registration: In the plugin's admin class (likely includes/admin/class-popularis-extra-admin.php), the action is registered:
   add_action( 'wp_ajax_popularis_extra_dismiss_notice', array( $this, 'popularis_extra_dismiss_notice' ) );
2. AJAX Handler: The function popularis_extra_dismiss_notice() is called when the admin-ajax.php endpoint receives the corresponding action.
3. Vulnerability Sink: The function likely retrieves a notice_id from $_POST and updates a WordPress option (e.g., update_option( 'popularis_extra_show_notice_' . $notice_id, 'no' )) without calling check_ajax_referer() or wp_verify_nonce().

4. Nonce Acquisition Strategy

According to the vulnerability description, the function suffers from missing or incorrect nonce validation.

• If the check is missing, no nonce is required for exploitation.
• If the check is incorrect (e.g., uses a hardcoded string or a fixed value), it can be easily bypassed.

For this plan, we assume the nonce check is entirely missing in version 1.2.10. If the agent finds a check_ajax_referer call in the source, it should check if the nonce is exposed via wp_localize_script:

• Localization Key: popularis_extra_admin (inferred)
• JS Variable: window.popularis_extra_admin?.nonce (inferred)

5. Exploitation Strategy

The goal is to demonstrate that an administrative notice can be dismissed via an unauthorized request.

1. Prerequisites: Use a logged-in administrator session.
2. Payload Preparation: Construct a POST request to admin-ajax.php.
3. Execution: Use the http_request tool to simulate the CSRF.

Request Details:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: action=popularis_extra_dismiss_notice&notice_id=test_poc_notice

6. Test Data Setup

1. Install Plugin: Ensure popularis-extra version 1.2.10 is installed and active.
2. Set Initial State: Ensure the option for the test notice is either deleted or set to 'yes' so the change is visible.
   • wp option update popularis_extra_show_notice_test_poc_notice yes --autoload=yes
3. Admin Session: Ensure the http_request tool is configured with the administrator's cookies.

7. Expected Results

• HTTP Response: Should return a 200 OK status with a JSON body indicating success (e.g., {"success":true} or 1).
• Database Change: The WordPress option popularis_extra_show_notice_test_poc_notice should be updated to no.

8. Verification Steps

After sending the HTTP request, verify the state change using WP-CLI:

wp option get popularis_extra_show_notice_test_poc_notice

Success Criteria: The command returns no.

9. Alternative Approaches

If popularis_extra_dismiss_notice is not the exact action name:

1. Grep for AJAX Actions:

   grep -r "wp_ajax_" /var/www/html/wp-content/plugins/popularis-extra/
   

2. Look for State Changes: Search for functions that use update_option or update_user_meta within those AJAX handlers.
3. Inspect Admin JS: Look at the plugin's JavaScript files in assets/js/ to see what AJAX actions are triggered when clicking "Dismiss" buttons in the dashboard. Common filenames: admin.js, notice.js.
4. Identify the missing check: Verify the handler function does not contain check_ajax_referer or wp_verify_nonce.