Exploitation Research Plan: CVE-2026-4301

1. Vulnerability Summary

The Rate Star Review Vote plugin (versions <= 1.6.4) contains a critical "Missing Authorization" vulnerability in its AJAX handler vwrsr_review. The handler is registered for both authenticated and unauthenticated users but contains an internal is_user_logged_in() check, effectively limiting exploitation to any authenticated user (including Subscribers).

The vulnerability exists because the code lacks:

1. Capability Checks: It does not verify if the user has the right to edit the target post.
2. Nonce Verification: It does not use WordPress CSRF protection.
3. Input Validation: It takes a user-provided rating_id and passes it directly to wp_update_post().

When the form parameter is set to update, an attacker can specify an arbitrary rating_id (representing a Post ID). The function then overwrites that post's title, content, author, status, and changes its post_type to review, effectively "hijacking" the post.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: vwrsr_review
• Vulnerable Parameter: rating_id (Target Post/Page ID)
• Authentication Required: Logged-in user (Subscriber role is sufficient).
• Payload Type: application/x-www-form-urlencoded
• Preconditions: The attacker must be authenticated as at least a Subscriber.

3. Code Flow

1. Hook Registration: In rate-star-review.php, the plugin registers the AJAX actions:

   add_action( 'wp_ajax_vwrsr_review', array('VWrateStarReview','vwrsr_review') );
   add_action( 'wp_ajax_nopriv_vwrsr_review', array('VWrateStarReview','vwrsr_review') );
   

2. Entry Point: The request reaches VWrateStarReview::vwrsr_review().
3. Check: The function checks is_user_logged_in(). If true, it proceeds.
4. Branching: The code checks if ($_GET['form'] == 'update') (or $_POST/$_REQUEST).
5. Sink (Metadata): At lines 758-763 (as per description), update_post_meta() is called using the rating_id.
6. Sink (Post Update): The function constructs an array for wp_update_post():
   • ID is set to the value of rating_id.
   • post_title is set from user input (likely review_title).
   • post_content is set from user input (likely review_text).
   • post_author is set to the current user's ID.
   • post_type is set to review.
7. Execution: wp_update_post() executes, modifying the arbitrary Post ID.

4. Nonce Acquisition Strategy

According to the vulnerability description, the vwrsr_review() handler lacks nonce verification. Therefore, no nonce is required to exploit this vulnerability.

If a nonce were required, it would likely be localized via wp_localize_script. Based on the file structure, the JS variable would likely be found by navigating to a page with the [videowhisper_review] shortcode.

5. Exploitation Strategy

The goal is to modify a target Page (e.g., Page ID 2, usually the "Sample Page") into a "review" post type with attacker-controlled content.

Step-by-Step Plan:

1. Authentication: Authenticate as a Subscriber-level user.
2. Target Identification: Identify a Post/Page ID to hijack (e.g., ID 2).
3. Request Construction: Send a POST request to admin-ajax.php.

Payload:

• Method: POST
• URL: http://<target>/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: vwrsr_review
  • form: update
  • rating_id: 2 (Target ID)
  • review_title: Hacked by Subscriber (Inferred parameter name)
  • review_text: Your content is now mine. (Inferred parameter name)
  • rating: 5 (Required for review logic)

Note: If review_title/review_text fail, common alternative names used by this developer include title, text, or content.

6. Test Data Setup

1. Target Content: Ensure a page with ID 2 exists (standard WordPress Sample Page).
   • wp post list --post_type=page
2. Attacker Account: Create a Subscriber user.
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
3. Plugin State: Ensure rate-star-review is active.

7. Expected Results

• HTTP Response: A successful response (likely a 200 OK with JSON or a success message).
• Database Change:
  • The post_type of ID 2 changes from page to review.
  • The post_title changes to "Hacked by Subscriber".
  • The post_author changes to the Subscriber's ID.
  • The post_status might change to publish.

8. Verification Steps

After the HTTP request, verify the state of the target post via WP-CLI:

# Check the post details for ID 2
wp post get 2 --fields=ID,post_title,post_author,post_type,post_status --format=json

The output should show the post_type as review and the post_author as the ID of the attacker user.

9. Alternative Approaches

If the form=update branch requires specific metadata to exist (i.e., verifying the post is already a review), the attack may fail on a clean Page ID.

Alternative:
Attempt to use the "add" functionality (where form is not update) if it also accepts a rating_id or post_id and incorrectly uses it in an update context.

If the parameter names review_title or review_text are incorrect, inspect the frontend HTML of a page containing the [videowhisper_review] shortcode to find the exact name attributes of the form inputs.

// Run in browser_eval on a page with the review form:
browser_eval("Array.from(document.querySelectorAll('input, textarea')).map(i => i.name)")