Vulnerability Research Plan: CVE-2026-25322 (PublishPress Revisions CSRF)

1. Vulnerability Summary

The PublishPress Revisions plugin (up to 3.7.22) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation in the rvy_admin_init() function located in admin/admin-init_rvy.php. This function handles the updating of plugin settings. Specifically, when the rvy_submit POST parameter is present, the plugin proceeds to save configuration options without verifying a security nonce. This allows an unauthenticated attacker to change site-wide revision settings by tricking an administrator into submitting a forged request.

2. Attack Vector Analysis

• Vulnerable Endpoint: Any administrative URL (e.g., /wp-admin/admin.php?page=revisionary-settings), as the vulnerable function is hooked to admin_init.
• Action: Plugin settings update.
• Vulnerable Parameter: rvy_submit.
• Required Authentication: Administrator (the victim must have an active session).
• Preconditions: The attacker must trick the administrator into clicking a link or visiting a malicious page that triggers a POST request to the WordPress admin panel.

3. Code Flow

1. Hook Registration: The plugin likely registers rvy_admin_init on the admin_init hook (standard WordPress behavior for functions named *_admin_init).
2. Entry Point: admin/admin-init_rvy.php:49

   if ( ! empty($_POST['rvy_submit']) || ! empty($_POST['rvy_defaults']) ) {
       require_once( RVY_ABSPATH . '/submittee_rvy.php');    
       $handler = new Revisionary_Submittee();
   
       if ( isset($_POST['rvy_submit']) ) {
           $sitewide = isset($_POST['rvy_options_doing_sitewide']);
           $customize_defaults = isset($_POST['rvy_options_customize_defaults']);
           $handler->handle_submission( 'update', $sitewide, $customize_defaults );
       }
       // ...
   }
   

3. Missing Validation: Notice that between line 49 and line 57, there is no call to check_admin_referer() or wp_verify_nonce().
4. Execution: The Revisionary_Submittee::handle_submission method (in submittee_rvy.php) iterates through the $_POST data and updates the plugin's option (usually stored in the revisionary_options array in the database).

4. Nonce Acquisition Strategy

No nonce is required for this exploit.
The vulnerability exists specifically because the plugin fails to check for a nonce before processing the rvy_submit action. An attacker can submit the request with zero knowledge of site secrets or nonces.

5. Exploitation Strategy

The goal is to change a visible setting, such as the revision_limit_per_post, to prove unauthorized modification of plugin configuration.

HTTP Request (PoC)

The security agent will perform an authenticated POST request as an Administrator (simulating the victim's browser being hijacked via CSRF).

• URL: http://localhost:8080/wp-admin/admin.php?page=revisionary-settings
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body:

  rvy_submit=1&revision_limit_per_post=1337&pending_revisions=1
  

• Tool: http_request

6. Test Data Setup

1. Install Plugin: Ensure PublishPress Revisions <= 3.7.22 is active.
2. Check Current State:

   wp option get revisionary_options
   

   (Identify if revision_limit_per_post is currently set to something other than 1337).

7. Expected Results

• The server should return a 302 Redirect (standard WordPress admin behavior after saving settings) or a 200 OK if the redirect is followed.
• The plugin will process the handle_submission call.
• The revision_limit_per_post value in the revisionary_options array will be updated to 1337.

8. Verification Steps

After the http_request is sent, verify the modification using WP-CLI:

# Get the options and check the specific key
wp option get revisionary_options --format=json | grep -o '"revision_limit_per_post":"1337"'

If the grep returns a match, the CSRF was successful.

9. Alternative Approaches

If revision_limit_per_post does not update (e.g., if the plugin expects specific input formats), try targeting the pending_revisions checkbox or the copy_posts_capability setting:

• Payload: rvy_submit=1&pending_revisions=0 (to disable pending revisions).
• Payload: rvy_submit=1&revision_queue_capability=subscriber (to potentially allow lower-privileged users to see the revision queue, if the capability is not strictly validated during save).

Note: checkboxes in WordPress settings often require the value '1' to be considered "checked" and are absent from POST if unchecked. The exploit should send rvy_submit=1 plus the target option name and its desired value.