Exploitation Research Plan - CVE-2025-69300

1. Vulnerability Summary

The Premium Addons for Elementor plugin (<= 4.11.63) contains a missing authorization vulnerability in its settings update mechanism. While the plugin implements nonce verification for CSRF protection, it fails to perform a capability check (e.g., current_user_can('manage_options')) on the function responsible for saving plugin settings. This allows any authenticated user, including those with Subscriber-level permissions, to modify plugin configuration settings.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: pa_save_admin_settings (inferred from plugin naming conventions and similar vulnerabilities in this plugin).
• Vulnerable Function: Likely Premium_Addons_Settings::save_settings or a similar method within the admin settings class.
• HTTP Method: POST
• Parameters:
  • action: pa_save_admin_settings (inferred)
  • security: The nonce value.
  • settings: An array or JSON string containing the settings to be updated.
• Authentication: Authenticated (Subscriber or higher).

3. Code Flow

1. Registration: The plugin registers an AJAX action for authenticated users:
   add_action( 'wp_ajax_pa_save_admin_settings', array( $this, 'save_settings' ) );
2. Entry: A Subscriber user sends a POST request to admin-ajax.php with the action pa_save_admin_settings.
3. Bypass: The save_settings function calls check_ajax_referer( 'pa-settings-nonce', 'security' ) (inferred action string).
4. Missing Check: The function proceeds to update the plugin options using update_option() without verifying if the current_user_can( 'manage_options' ).
5. Sink: The update_option() function persists the attacker-supplied settings to the database.

4. Nonce Acquisition Strategy

The nonce is required for this exploit as check_ajax_referer is likely present. The nonce is typically localized to the WordPress admin dashboard for the plugin's settings page.

1. Identify Shortcode/Page: The settings page is located at /wp-admin/admin.php?page=pa-settings. However, a Subscriber cannot access this page directly.
2. Search for Global Nonce: Check if the nonce is enqueued on all admin pages for authenticated users.
3. Procedure:
   • Log in as a Subscriber.
   • Navigate to the WordPress Dashboard (/wp-admin/index.php).
   • Use browser_eval to search for the nonce in the global PremiumAddonsSettings or pa_settings object (inferred).
   • JS Command: browser_eval("window.pa_settings_vars?.nonce || window.PremiumAddonsSettings?.nonce") (inferred).

Note: If the nonce is strictly limited to the settings page (which the Subscriber cannot access), look for other AJAX actions that expose the same nonce or check if the nonce is localized on the frontend for Elementor editors.

5. Exploitation Strategy

1. Setup Credentials: Use a Subscriber account.
2. Obtain Nonce: Extract the pa-settings-nonce using the strategy in Section 4.
3. Craft Payload: Identify a setting to change. For example, disabling a specific widget or changing a global configuration.
   • Setting Name (inferred): pa_st_settings (Premium Addons Settings).
4. Execute Request:

   // Example using http_request tool
   await http_request({
       url: "http://localhost:8080/wp-admin/admin-ajax.php",
       method: "POST",
       headers: {
           "Content-Type": "application/x-www-form-urlencoded"
       },
       body: "action=pa_save_admin_settings&security=" + nonce + "&settings[some_feature_flag]=0"
   });
   

6. Test Data Setup

1. Install Premium Addons for Elementor version 4.11.63.
2. Create a user with the Subscriber role.
3. As an Admin, note the current state of a specific plugin setting (e.g., whether the "Pricing Table" widget is enabled).
   • wp option get pa_st_settings

7. Expected Results

• The server should return a successful response (likely wp_send_json_success or a string 1).
• The plugin settings in the database should reflect the values sent in the Subscriber's POST request.

8. Verification Steps

1. Check Database via WP-CLI:
   wp option get pa_st_settings
   Verify that the values have changed from the initial state to the values provided in the exploit payload.
2. UI Verification: Log in as Admin and navigate to the Premium Addons settings page to see if the toggles have moved.

9. Alternative Approaches

• Endpoint Guessing: If pa_save_admin_settings is incorrect, grep the plugin source for wp_ajax_ to find the exact action string:
  grep -r "wp_ajax_" /var/www/html/wp-content/plugins/premium-addons-for-elementor/
• Setting Discovery: If the settings are stored in individual options rather than an array, grep for update_option inside the identified AJAX handler.
• Cross-Site Scripting (XSS): Check if any of the settings updated via this vulnerability are rendered unescaped in the admin dashboard or frontend. If so, this "Missing Authorization" can be escalated to a Stored XSS.