Exploitation Research Plan - CVE-2026-59521

1. Vulnerability Summary

The Real Testimonials plugin (versions <= 3.1.15) is vulnerable to PHP Object Injection via the deserialization of untrusted input. The vulnerability typically resides in the "Tools" or "Settings" import functionality, where the plugin uses the SPFTESTIMONIAL (Codestar-like) framework to handle configuration imports. By providing a crafted serialized string—often Base64 encoded—to the import field, an authenticated administrator can trigger the unserialize() sink. While no POP chain is identified in the plugin itself, any chain present in the WordPress environment (other plugins/themes) can be leveraged for RCE or file manipulation.

2. Attack Vector Analysis

• Target Endpoint: /wp-admin/edit.php?post_type=spt_testimonial&page=testimonial_tools
• Vulnerable Parameter: The import data field, typically named after the framework prefix: sp_testimonial_pro_tools[import] or a similar key within the POST body.
• Authentication: Required (Administrator+).
• Preconditions: The attacker must have access to the "Tools" submenu under the "Real Testimonials" menu.

3. Code Flow

1. Registration: The "Tools" page is registered in src/Admin/Views/Framework/configs/tools.php with the unique prefix sp_testimonial_pro_tools.
2. Framework Initialization: The SPFTESTIMONIAL_Options class (in src/Admin/Views/Framework/Classes/options.class.php) initializes the settings page for this prefix.
3. Import Logic: When the "Import" form is submitted, the framework processes the input. In the underlying framework (Codestar derivative), the import field type triggers a block of code that:
   • Retrieves the string from the POST request or uploaded file.
   • Decodes it (if Base64 encoded).
   • Passes it to unserialize() or maybe_unserialize() to restore the option array.
4. Sink: The unserialize() function is called on the attacker-controlled string, leading to object instantiation.

4. Nonce Acquisition Strategy

The "Tools" page uses a nonce for form security.

1. Identify Page: The "Tools" page is located at edit.php?post_type=spt_testimonial&page=testimonial_tools.
2. Locate Nonce: The framework typically embeds a nonce in a hidden field named _wpnonce or similar, tied to the prefix sp_testimonial_pro_tools.
3. Extraction:
   • Navigate to the Tools page.
   • Use browser_eval to extract the nonce from the form.
   • Variable check: Look for window.sp_testimonial_pro_tools_vars or simply the hidden input field.

// Example extraction via browser_eval
document.querySelector('input[name="_wpnonce"]')?.value || 
document.querySelector('input[name="sp_testimonial_pro_tools_nonce"]')?.value;

5. Exploitation Strategy

Step 1: Preparation

Construct a simple PHP Object Injection payload. Since no specific POP chain is required for the PoC, we use stdClass.

• Payload: O:8:"stdClass":1:{s:3:"foo";s:3:"bar";}
• Encoding: Base64 encode the payload if the framework expects it (likely): Tzo4OiJzdGRDbGFzcyI6MTp7czozOiJmb28iO3M6MzoiYmFyIjt9

Step 2: HTTP Request

Use the http_request tool to send a POST request to the Tools page.

• URL: https://<target>/wp-admin/edit.php?post_type=spt_testimonial&page=testimonial_tools
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  sp_testimonial_pro_tools%5Bimport%5D=Tzo4OiJzdGRDbGFzcyI6MTp7czozOiJmb28iO3M6MzoiYmFyIjt9&_wpnonce=<NONCE>&sp_testimonial_pro_tools_import_button=1
  

  (Note: Parameter names like sp_testimonial_pro_tools_import_button are inferred from standard framework behavior and should be verified via browser_eval on the page source.)

6. Test Data Setup

1. Plugin Installation: Ensure "Real Testimonials" <= 3.1.15 is installed and activated.
2. User: An Administrator user is required for the session.
3. Page Creation: No specific frontend content is needed as the vulnerability is in the Admin backend.

7. Expected Results

• The server processes the request.
• If a debugger like Xdebug is active or the object has a __wakeup method that triggers an error, the error will be visible.
• In a successful "blind" injection, the framework might attempt to replace existing options with the "array" it expected, potentially breaking plugin settings (a sign that the data was processed).

8. Verification Steps

Since this is a deserialization vulnerability without a confirmed POP chain in the plugin, verification involves confirming the sink is reached:

1. Error Logs: Check wp-content/debug.log for "Notice: unserialize(): Error at offset..." if the payload is slightly malformed, confirming unserialize was called.
2. Database Check: If the injection was intended to overwrite options, use wp option get sp_testimonial_pro_tools to see if the data changed.
3. Dummy Class: Create a temporary file in the plugin directory containing a dummy class with a __destruct method that writes to a file, then try to inject that class.

9. Alternative Approaches

• File Upload: The tools.php file defines the import as "Import JSON/CSV File". If the POST parameter fails, try uploading a .json file containing the serialized string via a multipart/form-data request to the same endpoint.
• Metabox Injection: Check if the save_meta_box function in src/Admin/Views/Framework/Classes/metabox.class.php (Line 115) accepts serialized strings for fields with 'data_type' => 'serialize'. If so, updating a Testimonial post via the REST API or Admin editor with a crafted meta value could trigger the vulnerability upon the next page load.