Exploitation Research Plan: CVE-2026-8424 (Remove Yellow BGBOX CSRF)

This plan outlines the process for analyzing and demonstrating the Cross-Site Request Forgery (CSRF) vulnerability in the Remove Yellow BGBOX plugin (<= 1.0).

1. Vulnerability Summary

The "Remove Yellow BGBOX" plugin fails to implement or correctly verify security nonces on its settings management page (rybb_api_settings). This oversight allows an unauthenticated attacker to craft a malicious request that, when executed by a logged-in administrator, overwrites or resets the plugin's configuration options.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-post.php or /wp-admin/options.php (inferred based on standard WordPress settings patterns).
• Action Hook: Likely admin_post_rybb_api_settings or admin_post_rybb_save_settings (inferred).
• Vulnerable Parameter: Configuration settings parameters (e.g., rybb_option_name, rybb_hex_code, etc.).
• Authentication Requirement: An authenticated Administrator must trigger the request (CSRF victim).
• Preconditions: The attacker must know the exact parameter names used in the settings form.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an admin page using add_options_page() or add_menu_page() with the slug rybb_api_settings.
2. Form Rendering: The callback function for this page renders an HTML <form> targeting either admin-post.php or options.php.
3. Processing Hook: The plugin uses add_action('admin_init', ...) or add_action('admin_post_...', ...) to listen for the form submission.
4. Vulnerable Sink: The handler function directly calls update_option() or update_site_option() using data from $_POST without first calling check_admin_referer() or wp_verify_nonce().

4. Nonce Acquisition Strategy

According to the vulnerability description, nonce validation is either missing or incorrect.

1. Verification of Missing Nonce:
   • First, inspect the settings page HTML for a nonce field: wp_nonce_field.
   • If no hidden input with a nonce is present in the form, the exploit requires no nonce.
2. Bypassing "Incorrect" Validation:
   • If a nonce exists but is "incorrectly validated," check if the plugin verifies the nonce but fails to die() on failure (e.g., if (!wp_verify_nonce(...)) { // does nothing }).
   • Check if the action string in wp_create_nonce (creation) differs from wp_verify_nonce (verification).

Agent Instruction for Discovery:

• Navigate to the settings page: browser_navigate("http://localhost:8080/wp-admin/options-general.php?page=rybb_api_settings") (verify the actual URL via wp-cli first).
• Use browser_eval to extract form details:

  (() => {
      const form = document.querySelector('form');
      return {
          action: form.getAttribute('action'),
          inputs: Array.from(form.querySelectorAll('input, select, textarea')).map(i => ({
              name: i.name,
              type: i.type,
              value: i.value
          }))
      };
  })()
  

5. Exploitation Strategy

The exploit will be a CSRF POST request that changes the plugin's settings.

1. Identify Parameters: Use the discovery step above to find the name attributes of the settings fields.
2. Craft Payload: Construct a URL-encoded body for a POST request.
3. Request Execution: Use http_request to simulate the admin's browser submitting the form.

Sample Request (Inferred Identifiers):

• Method: POST
• URL: http://localhost:8080/wp-admin/admin-post.php
• Headers:
  • Content-Type: application/x-www-form-urlencoded
  • Cookie: [Admin Session Cookies]
• Body:

  action=rybb_save_settings&rybb_background_color=%23ff0000&rybb_enabled=1&submit=Save+Changes
  

6. Test Data Setup

1. Install Plugin: wp plugin install remove-yellow-bgbox --version=1.0 --activate
2. Identify Options: Run wp option list --search="rybb*" to see current plugin settings.
3. Set Initial State: Set a known value for a plugin setting to verify it changes later.
   • Example: wp option update rybb_background_color "#ffffff"

7. Expected Results

• The http_request should return a 302 Found redirect (common for WordPress admin settings saves).
• The plugin configuration stored in the wp_options table should be updated to the attacker-supplied values.

8. Verification Steps

1. Check Database: Use wp-cli to verify the option has changed.
   • wp option get [found_option_name]
2. UI Verification: Navigate back to the settings page via browser_navigate and use browser_eval to check if the input fields now contain the malicious values.

9. Alternative Approaches

• AJAX Handler: If the plugin saves settings via AJAX, the endpoint will be /wp-admin/admin-ajax.php. Search for wp_ajax_ hooks in the plugin source.
• GET-based CSRF: If the plugin uses $_REQUEST instead of $_POST and doesn't check the request method, the attack can be executed via a simple <img> tag or window.location redirect. Check the handler for usage of $_GET or $_REQUEST.
• Reset Attack: If the description mentions "reset," look for a specific parameter (like action=reset or a reset button name) that triggers delete_option().