Rankology SEO and Analytics Tool <= 2.0 - Incorrect Authorization to Authenticated (Editor+) Header & Footer Code Creation

This research plan outlines the steps required to analyze and exploit CVE-2025-12958, an improper authorization vulnerability in the Rankology SEO and Analytics Tool plugin.

1. Vulnerability Summary

The Rankology SEO and Analytics Tool plugin (<= 2.0) contains a vulnerability that allows authenticated users with Editor privileges to inject arbitrary code (HTML/JavaScript) into the site's header and footer. This occurs because the plugin uses an insufficient capability check (likely edit_posts or similar Editor-level capability) when processing updates on the rankology_code_block administration page, instead of restricting this sensitive action to users with manage_options (Administrators).

By injecting malicious scripts into the header or footer, an Editor can achieve Stored Cross-Site Scripting (XSS) that executes in the context of all site visitors, including Administrators.

2. Attack Vector Analysis

• Endpoint: Admin POST handler (likely wp-admin/admin.php?page=rankology_code_block or admin-post.php).
• Action/Hook: The plugin likely uses an admin_init or admin_menu hook to handle POST data when the "Code Block" settings are saved.
• Vulnerable Parameter: Parameters responsible for header and footer content (e.g., rankology_header_code and rankology_footer_code [inferred]).
• Authentication: Authenticated, Editor role or higher.
• Preconditions: The plugin must be active. The attacker must have a valid Editor session.

3. Code Flow

1. Entry Point: An Editor user navigates to /wp-admin/admin.php?page=rankology_code_block.
2. Form Submission: The user submits a form containing the desired header/footer scripts.
3. Vulnerable Logic: The plugin intercepts the request (likely in a function hooked to admin_init or within the menu callback).
4. Incorrect Capability Check: The code performs a check similar to:
   if ( current_user_can( 'edit_posts' ) ) { // VULNERABLE: Editors have this cap }
   instead of:
   if ( current_user_can( 'manage_options' ) ) { // Correct for sensitive settings }
5. Persistence: The plugin saves the unsanitized or incorrectly authorized input into the WordPress options table (e.g., update_option('rankology_header_script', ...)).
6. Sink: The saved code is echoed onto the frontend using hooks like wp_head or wp_footer.

4. Nonce Acquisition Strategy

To bypass CSRF protections, we must obtain a valid nonce generated for the rankology_code_block page.

1. Identify Nonce: The nonce is likely created via wp_nonce_field() or wp_create_nonce() and localized/rendered in the admin page HTML.
2. Access Page: Log in as an Editor and navigate to the vulnerable admin page.
3. Extraction:
   • The execution agent will use browser_navigate to http://localhost:8080/wp-admin/admin.php?page=rankology_code_block.
   • Use browser_eval to extract the nonce from the form:
     browser_eval("document.querySelector('input[name=\"_wpnonce\"]')?.value || document.querySelector('input[name=\"rankology_nonce\"]')?.value")
   • Also, identify the exact names of the textareas for header/footer code.

5. Exploitation Strategy

The goal is to update the site header with a tracking script or a simple alert() to prove XSS.

Step-by-Step:

1. Login: Authenticate as an Editor.
2. Scrape Metadata: Visit the rankology_code_block page to get the _wpnonce and the exact parameter names used in the POST request.
3. Construct Payload: Create a script payload: <script>console.log("CVE-2025-12958_Exploited")</script>.
4. Execute POST Request: Use the http_request tool to send a multipart/form-data or URL-encoded POST request to the admin page.

Request Template (Inferred):

POST /wp-admin/admin.php?page=rankology_code_block HTTP/1.1
Host: localhost:8080
Content-Type: application/x-www-form-urlencoded
Cookie: [Editor Cookies]

rankology_header_code=<script>alert(1)</script>&rankology_footer_code=&submit=Save+Changes&_wpnonce=[EXTRACTED_NONCE]

6. Test Data Setup

1. Install Plugin: Ensure Rankology SEO and Analytics Tool version 2.0 is installed and active.
2. Create Editor:
   wp user create editor_user editor@example.com --role=editor --user_pass=password123
3. Permissions Check: Confirm the Editor can see the "Rankology" menu item (which itself is part of the vulnerability).

7. Expected Results

• Response: A 302 Redirect back to the settings page with a settings-updated=true parameter or a 200 OK containing a success message.
• Data Persistence: The malicious script is saved in the database.
• Frontend Execution: When viewing the site homepage, the injected script <script>alert(1)</script> appears in the <head> or before </body>.

8. Verification Steps

1. Check Database via CLI:
   wp option get rankology_header_code (Adjust option name based on findings).
2. Verify Frontend Output:
   Use http_request to GET the site root and grep for the payload:
   http_request --url "http://localhost:8080/" | grep "alert(1)"
3. Confirm Capability: Try to perform the same action as a Contributor (which should fail) to verify it is specifically an Editor+ authorization flaw.

9. Alternative Approaches

• Direct Option Update (REST API): If the plugin registers these settings via register_setting without proper show_in_rest permissions/callbacks, check if they can be modified via POST /wp-json/wp/v2/settings.
• Admin-Ajax/Admin-Post: If the settings page uses a dedicated handler, look for wp_ajax_rankology_save_code or admin_post_rankology_save_code hooks and verify if they lack current_user_can('manage_options').