Research Plan: CVE-2025-69361 Missing Authorization in Post Expirator

1. Vulnerability Summary

The Schedule Post Changes With PublishPress Future (formerly Post Expirator) plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.9.3. The vulnerability exists because an AJAX or administrative handler fails to perform a current_user_can() check before processing requests that modify post expiration metadata. This allows authenticated users with at least Contributor-level access to schedule, modify, or delete expiration actions for any post on the site, regardless of whether they have permission to edit that specific post.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: postexpirator_update (Inferred from common plugin naming conventions; needs verification via grep)
• Vulnerable Parameter: post_id
• Authentication: Authenticated (Contributor or higher).
• Preconditions: The attacker must be logged in as a Contributor and have access to the WordPress admin dashboard.

3. Code Flow

1. Entry Point: The plugin registers an AJAX action for logged-in users:
   add_action('wp_ajax_postexpirator_update', array($this, 'ajax_save_post_expiration_date')); (Inferred)
2. Missing Check: The callback function (e.g., ajax_save_post_expiration_date) likely calls check_ajax_referer() to verify a nonce but fails to call current_user_can('edit_post', $post_id).
3. Execution Sink: The function takes the post_id from the $_POST array and updates the _expiration-date, _expiration-date-status, and _expiration-date-options post meta fields.
4. Trigger: The WP-Cron system later executes the scheduled action (e.g., trash, delete, category-add) based on these unauthorized meta values.

4. Nonce Acquisition Strategy

The plugin enqueues a script and localizes data containing a nonce on the post editing screens. Since a Contributor can create and edit their own posts, they can extract a valid nonce from their own edit page and use it to target posts they do not own.

1. Create Page: Create a temporary post as a Contributor:
   wp post create --post_type=post --post_title="Nonce Grab" --post_status=author --post_author=[CONTRIBUTOR_ID]
2. Navigate: Open the browser and navigate to the edit page for that post:
   /wp-admin/post.php?post=[POST_ID]&action=edit
3. Extract Nonce: Use browser_eval to extract the nonce from the localized JS object.
   • Object Name: postexpirator (or publishPressFutureConfig)
   • Key: nonce
   • Command: browser_eval("window.postexpirator?.nonce || window.publishPressFutureConfig?.nonce")

5. Exploitation Strategy

1. Discovery: Identify the ID of a target post owned by an Admin (e.g., post_id=1).
2. Preparation: Obtain the valid nonce using the strategy in Section 4.
3. Craft Payload: Construct a POST request to admin-ajax.php to set the target post to be trashed in the near future.
   • Action: postexpirator_update
   • Nonce: [EXTRACTED_NONCE]
   • Post ID: 1 (The Admin post)
   • Enabled: true
   • Year/Month/Day/Hour/Minute: Set to a time 2 minutes in the future.
   • Action Type: trash (or delete)
4. Send Request: Use http_request to send the payload.

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=postexpirator_update&nonce=[NONCE]&post_id=1&enabled=true&expirationdate_year=2025&expirationdate_month=01&expirationdate_day=01&expirationdate_hour=10&expirationdate_minute=30&expirationdate_action=trash

6. Test Data Setup

1. Target: An existing post (ID 1) created by the Admin user.
2. Attacker: A user with the contributor role.
3. Plugin Config: Ensure the plugin is active and configured to allow expiration for the 'post' type (usually default).

7. Expected Results

• The AJAX request should return a successful response (likely a JSON object or 1).
• The post meta for the target post (ID 1) should be updated with the malicious expiration settings.
• The Admin's post is now scheduled to be automatically trashed by the plugin, despite the Contributor having no rights to edit it.

8. Verification Steps

1. Check Meta: Use WP-CLI to verify the meta fields for the target post:
   wp post meta list 1 --keys=_expiration-date,_expiration-date-status,_expiration-date-options
2. Verify Change: Confirm the values match the payload sent by the Contributor.
3. Check Scheduled Actions: Verify if the plugin has registered a scheduled action for this post:
   wp cron event list | grep postexpirator

9. Alternative Approaches

• Inferred Action Names: If postexpirator_update is incorrect, search for wp_ajax_ in the plugin directory:
  grep -r "wp_ajax_" /var/www/html/wp-content/plugins/post-expirator/
• Settings Modification: Check if the missing authorization applies to publishpressfuture_save_settings (REST or AJAX), which could allow changing global plugin behaviors.
• REST API: Check if the plugin registers any REST routes under publishpress-future/v1 that handle post updates without permission checks.