Exploitation Research Plan - CVE-2026-3499

1. Vulnerability Summary

The Product Feed PRO for WooCommerce plugin (versions 13.4.6 - 13.5.2.1) is vulnerable to Cross-Site Request Forgery (CSRF). Multiple administrative AJAX handlers fail to implement or correctly validate nonces. This allows an attacker to trick a logged-in administrator into triggering sensitive actions, such as database migrations, clearing caches, altering feed settings, and deleting feed data.

2. Attack Vector Analysis

• Endpoints: /wp-admin/admin-ajax.php
• Actions:
  1. woosea_migrate_to_custom_post_type
  2. adt_clear_custom_attributes_product_meta_keys
  3. woosea_update_file_url_to_lower_case
  4. woosea_use_legacy_filters_and_rules
  5. woosea_fix_duplicate_feed
• Method: POST
• Authentication Required: Administrator (via CSRF)
• Preconditions: A site administrator must be logged in and tricked into visiting a malicious page that submits a request to the target site.

3. Code Flow

1. Entry Point: The plugin registers AJAX actions in includes/Classes/Product_Feed_Admin.php (inferred from .pot file references) or a similar admin handler class using add_action( 'wp_ajax_woosea_...', ... ).
2. JS Trigger: In includes/Classes/WP_Admin.php, the plugin enqueues woosea_manage.js. This script handles UI buttons on the "Manage Feeds" page.
3. Vulnerable Sink: The registered callback functions (e.g., ajax_use_legacy_filters_and_rules) execute administrative logic. In the affected versions, these functions lack a call to check_ajax_referer() or wp_verify_nonce(), or they use a static/predictable token that is not properly validated.
4. Execution: The function performs the action (e.g., update_option('adt_use_legacy_filters_and_rules', 'yes')) without verifying the intent of the user.

4. Nonce Acquisition Strategy

According to the vulnerability description, nonce validation is missing or incorrect.

• Primary Strategy: Attempt the exploit without a nonce. The woosea_manage_params localization in includes/Classes/WP_Admin.php notably lacks a nonce key, suggesting the developers simply didn't include one in the AJAX request data for these specific actions.
• Secondary Strategy (If a nonce is checked but incorrectly): If the handler expects a parameter like security, check if it accepts the generic WordPress REST nonce or a nonce intended for a different action.
• Variable Identification: Check the global adtObj or woosea_manage_params in the browser console.
  • Path: window.woosea_manage_params

5. Exploitation Strategy

We will target the woosea_use_legacy_filters_and_rules action as it provides a clear, verifiable change in the database.

Step-by-Step Exploit (using http_request):

1. Identify the Target Action: woosea_use_legacy_filters_and_rules.
2. Prepare Payload: Craft a POST request that toggles the legacy filters setting.
3. Execute Request:
   • URL: https://[TARGET]/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body: action=woosea_use_legacy_filters_and_rules
4. Expected Response: A successful trigger usually returns 1, true, or a JSON success message like {"success":true}.

6. Test Data Setup

1. Install Plugin: Install Product Feed PRO for WooCommerce version 13.5.2.1.
2. Activate Plugin: Ensure the plugin is active.
3. Verify Initial State:
   • Run: wp option get adt_use_legacy_filters_and_rules
   • Note if it is 'no' or if the option doesn't exist.

7. Expected Results

• The AJAX request to admin-ajax.php should return a 200 OK status.
• The response body should indicate success (e.g., 1).
• The internal state of the WordPress site (specifically the targeted option) will be modified.

8. Verification Steps

After sending the HTTP request, use WP-CLI to confirm the administrative action was performed:

# Verify the legacy filters toggle
wp option get adt_use_legacy_filters_and_rules

# If targeting fix_duplicate_feed, verify total feed counts (requires setup of duplicates)
wp post list --post_type=adt_product_feed --format=count

9. Alternative Approaches

If woosea_use_legacy_filters_and_rules is patched or behaves differently, target the Duplicate Feed Fixer:

• Action: woosea_fix_duplicate_feed
• Purpose: Deletes duplicate feed posts.
• Verification: Create two feeds with identical names and check if one is deleted after the AJAX call.

If the AJAX handlers require a generic "security" token, attempt to extract it from the "About" page where other AdTribes nonces are often localized:

1. wp post create --post_type=page --post_content='[woosea_manage_feeds]' (if shortcode exists)
2. browser_navigate to the created page.
3. browser_eval("window.woosea_manage_params") to find any potential tokens.