Exploitation Research Plan - CVE-2026-48969

1. Vulnerability Summary

CVE-2026-48969 is a Missing Authorization vulnerability in the Really Simple Security (formerly Really Simple SSL) plugin (versions <= 9.5.9). The vulnerability exists because a specific function—likely an AJAX or REST API handler used for managing security settings or 2FA—fails to perform a capability check (e.g., current_user_can('manage_options')). This allows any authenticated user with Subscriber privileges to execute administrative actions, such as toggling security hardening features or modifying plugin configurations.

2. Attack Vector Analysis

• Endpoint: WordPress AJAX (/wp-admin/admin-ajax.php) or the WordPress REST API (/wp-json/really-simple-ssl/v1/...).
• Action/Route: Based on the plugin's architecture, the target is likely one of the following:
  • AJAX Action: rsssl_save_settings or rsssl_toggle_hardening (inferred).
  • REST Route: really-simple-ssl/v1/settings (inferred).
• Payload Parameter: Usually a JSON object or POST array containing setting keys and values (e.g., {"hardening_feature_id": "disable_xmlrpc", "value": false}).
• Authentication: Authenticated, Subscriber-level access or higher.
• Preconditions: The plugin must be active, and the attacker must have a valid Subscriber session.

3. Code Flow (Inferred)

1. Registration: The plugin registers an AJAX handler using add_action( 'wp_ajax_rsssl_...', 'handler_function' ).
2. Access: Because it is registered under wp_ajax_ (not wp_ajax_nopriv_), it is accessible to any logged-in user.
3. The Flaw: Inside the handler_function, the code checks for a valid nonce (CSRF protection) but fails to check if the current user has the manage_options capability.
4. Execution: The function proceeds to update the plugin's options in the wp_options table or modifies a user's security metadata.

4. Nonce Acquisition Strategy

The plugin localizes security data into the WordPress admin dashboard. Even Subscribers can often see the localized script objects if the plugin enqueues them on the profile page or a shared dashboard.

1. Identify Script Object: The plugin uses the rsssl namespace. Based on assets/css/admin.css, the localization key is likely rsssl_settings or rsssl_admin.
2. Shortcode/Page Trigger: To ensure the script is loaded, navigate to the Subscriber's profile page (/wp-admin/profile.php) or the plugin's dashboard if visible.
3. Extraction:
   • Navigate to the dashboard using browser_navigate.
   • Execute JS to find the nonce:

     browser_eval("window.rsssl_settings?.nonce || window.rsssl_admin?.nonce")
     

4. Action Check: Verify if the nonce action matches the verification string in the PHP (e.g., rsssl_nonce or rsssl_settings_nonce).

5. Exploitation Strategy

This plan targets the unauthorized modification of security hardening settings.

Step 1: Authentication

Log in as a Subscriber user to obtain a session cookie.

Step 2: Nonce Extraction

Use the browser_eval tool on any admin page where really-simple-ssl scripts are enqueued to extract the rsssl_nonce.

Step 3: Unauthorized Action (Example: Disabling a Hardening Feature)

Request:

• Tool: http_request
• Method: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=rsssl_save_settings&nonce=[EXTRACTED_NONCE]&settings={"disable_xmlrpc":0,"block_code_execution_uploads":0}
  

  (Note: Parameters names like disable_xmlrpc are inferred from the plugin's "Hardening" features visible in assets/css/admin/modules/dashboard.scss)

6. Test Data Setup

1. Install Really Simple Security <= 9.5.9.
2. Configure the plugin as an Administrator and enable several hardening features (e.g., "Disable Directory Browsing").
3. Create a user with the Subscriber role.
4. Ensure the "Hardening" features are active in the wp_options table (check rsssl_options).

7. Expected Results

• Successful Exploit: The server returns a 200 OK or a JSON success message {"success": true}.
• Impact: The security hardening features that were previously "Enabled" are now "Disabled" in the plugin settings, despite the request coming from a Subscriber.

8. Verification Steps

1. WP-CLI Check:

   wp option get rsssl_options
   

   Verify that the hardening values have changed (e.g., 0 or false for the targeted features).
2. Admin UI Check: Log in as an Administrator and navigate to the Really Simple Security Dashboard. Observe that the hardening features have been toggled off.

9. Alternative Approaches

If the rsssl_save_settings AJAX action is protected, target the REST API:

• Endpoint: GET /wp-json/really-simple-ssl/v1/settings
• Method: POST
• Header: X-WP-Nonce: [EXTRACTED_NONCE] (Get this nonce using wp_create_nonce('wp_rest') context).
• Logic: REST routes often have a permission_callback. If this returns __return_true or only checks is_user_logged_in(), the settings can be manipulated via a JSON POST request.