Shortcodes and extra features for Phlox <= 2.17.14 - Missing Authorization

This research plan targets CVE-2025-69016, a missing authorization vulnerability in the Shortcodes and extra features for Phlox (auxin-elements) plugin. This vulnerability allows authenticated users with subscriber-level permissions to trigger actions that should be restricted to administrators.

1. Vulnerability Summary

• Vulnerability: Missing Authorization (Missing Capability Check).
• Location: Likely within an AJAX handler registered in includes/admin/classes/class-auxin-admin-ajax.php or includes/classes/class-auxin-ajax.php.
• Root Cause: The plugin registers an AJAX action for authenticated users (wp_ajax_...) and verifies a CSRF nonce but fails to verify the user's capabilities (e.g., current_user_can('manage_options')).
• Impact: A subscriber can perform unauthorized actions, such as dismissing administrative notices or potentially updating specific plugin settings (options) prefixed with auxin_.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: auxin_dismiss_notice (High probability candidate for "Missing Authorization" in Phlox/Auxin) or auxin_dismiss_review_notice.
• Parameter: id (The ID of the notice/option to update) and nonce (The security token).
• Authentication: Subscriber-level access is required. Subscribers can access the WordPress dashboard (/wp-admin/profile.php), which triggers the loading of localized admin variables.
• Precondition: The plugin must be active, and a subscriber account must exist.

3. Code Flow (Inferred)

1. Registration: The plugin calls add_action( 'wp_ajax_auxin_dismiss_notice', array( $this, 'dismiss_notice' ) );. Note that wp_ajax_nopriv_ is likely not used, matching the "authenticated" requirement.
2. Entry: A subscriber sends a POST request to admin-ajax.php with action=auxin_dismiss_notice.
3. Nonce Verification: The handler calls check_ajax_referer( 'auxin_nonce', 'nonce' );.
4. Authorization Gap: The handler fails to call current_user_can().
5. Sink: The handler executes a privileged operation, such as update_option( 'auxin_dismissed_' . $_POST['id'], 1 );.

4. Nonce Acquisition Strategy

The auxin-elements plugin localizes its admin data in a JavaScript object called auxin_admin_vars. This object contains the nonce required for the AJAX request.

1. Login: Authenticate as a Subscriber.
2. Navigate: Go to /wp-admin/profile.php. This ensures the WordPress admin environment is loaded.
3. Extract Nonce: Use the browser_eval tool to retrieve the nonce from the global JavaScript object.
   • JS Variable: window.auxin_admin_vars?.nonce (or check for auxin_admin_vars.auxin_nonce).
4. Action Check: Confirm the nonce is intended for the auxin_nonce action string (default for Phlox/Auxin).

5. Exploitation Strategy

The goal is to demonstrate that a Subscriber can update a WordPress option (prefixed by the plugin).

1. Identify the target action: The most likely vulnerable function is auxin_dismiss_notice.
2. Prepare Payload:
   • action: auxin_dismiss_notice
   • id: test_vulnerability_marker (This will create/update an option named auxin_dismissed_test_vulnerability_marker)
   • nonce: [Extracted in Step 4]
3. Send Request: Use http_request to send a POST request.
   • URL: http://localhost:8080/wp-admin/admin-ajax.php
   • Headers: Content-Type: application/x-www-form-urlencoded, Cookie: [Subscriber Cookies]
   • Body: action=auxin_dismiss_notice&id=test_vulnerability_marker&nonce=[NONCE]

6. Test Data Setup

1. Target Plugin: Install and activate auxin-elements version 2.17.14.
2. User Creation:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
   

3. Initial State Check: Verify that the test option does not exist yet.

   wp option get auxin_dismissed_test_vulnerability_marker
   

7. Expected Results

• Response: The server should return a JSON success response: {"success":true}.
• Database Change: An option entry auxin_dismissed_test_vulnerability_marker should now exist in the wp_options table with the value 1.
• Bypass: The action is completed despite the user only having subscriber permissions (who cannot normally manage options).

8. Verification Steps

After performing the HTTP request, verify the modification using WP-CLI:

# Check if the option was successfully created/updated
wp option get auxin_dismissed_test_vulnerability_marker

If the command returns 1, the exploitation is successful.

9. Alternative Approaches

If auxin_dismiss_notice is not the vulnerable function, search the codebase for other AJAX handlers registered without capability checks:

1. Grep for AJAX handlers:

   grep -rn "wp_ajax_" /var/www/html/wp-content/plugins/auxin-elements/
   

2. Analyze Handlers: Check the corresponding functions in includes/admin/classes/class-auxin-admin-ajax.php. Look for any function that:
   • Uses update_option, update_post_meta, or delete_post.
   • Lacks current_user_can.
3. Common Candidate Actions:
   • auxin_update_post_order
   • auxin_metabox_ajax_save_post
   • auxin_save_shortcode (Look for XSS or Sensitive Data exposure here).

If auxin_admin_vars is not found, search for wp_localize_script in the plugin code to identify the correct JS object name:

grep -rn "wp_localize_script" /var/www/html/wp-content/plugins/auxin-elements/