Simple Ajax Chat <= 20251121 - Unauthenticated Information Exposure

This plan outlines the process for investigating and exploiting CVE-2026-3075, an unauthenticated information exposure vulnerability in the Simple Ajax Chat plugin.

1. Vulnerability Summary

The Simple Ajax Chat plugin (up to version 20251121) fails to properly sanitize or restrict data returned via its AJAX handlers. Specifically, the handler responsible for retrieving chat messages or user lists likely includes sensitive fields such as user IP addresses, email addresses, or internal database identifiers that should not be visible to unauthenticated users. This is caused by a lack of capability checks (current_user_can) or improper data filtering before the JSON/HTML response is sent.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: sac_get_messages (inferred based on plugin functionality; the agent must verify this in the source).
• Payload Parameter: action=sac_get_messages
• Authentication: Unauthenticated (wp_ajax_nopriv_ hook).
• Preconditions:
  1. The plugin must be active.
  2. At least one chat room must exist or the default chat must have messages.
  3. A valid nonce may be required for the AJAX request.

3. Code Flow

1. Registration: The plugin registers AJAX handlers in the main plugin file (likely simple-ajax-chat.php) or a specific AJAX class:

   add_action('wp_ajax_sac_get_messages', 'sac_get_messages');
   add_action('wp_ajax_nopriv_sac_get_messages', 'sac_get_messages');
   

2. Entry Point: An unauthenticated user sends a request to admin-ajax.php?action=sac_get_messages.
3. Processing: The sac_get_messages() function (or similar) is invoked.
4. Data Retrieval: The function queries the database (e.g., {$wpdb->prefix}simple_ajax_chat) for recent messages.
5. Vulnerable Sink: The retrieved records, which often contain columns like user_ip, user_id, or user_email, are processed and returned to the client via echo or wp_send_json(). The vulnerability exists because the code does not check if the requester has the manage_options capability before including sensitive metadata in the response.

4. Nonce Acquisition Strategy

Simple Ajax Chat typically enqueues a script that localizes settings, including a nonce for the AJAX requests.

1. Identify Shortcode: The plugin uses [sac_chat] or [simple-ajax-chat] to display the chat box.
2. Setup Page: Create a public page containing the chat:

   wp post create --post_type=page --post_status=publish --post_title="Chat Page" --post_content='[sac_chat]'
   

3. Extract Nonce:
   • Navigate to the newly created page using browser_navigate.
   • Simple Ajax Chat usually localizes its data into a global JS variable. Search for sac_vars, sac_data, or sac_options.
   • Execution Command:

     browser_eval("window.sac_vars?.sac_nonce || window.sac_data?.nonce")
     

   • Note: If wp_verify_nonce is called with -1 or if the check is missing in the nopriv handler, this step may be optional.

5. Exploitation Strategy

1. Target URL: http://localhost:8080/wp-admin/admin-ajax.php
2. Method: POST (or GET, depending on the handler's $_REQUEST usage).
3. Headers: Content-Type: application/x-www-form-urlencoded
4. Payload (Example):

   action=sac_get_messages&sac_nonce=[EXTRACTED_NONCE]&sac_last_id=0
   

   • sac_last_id=0 is often used to fetch the entire history from the beginning.
5. Response Analysis:
   • Examine the response for fields like "ip", "user_id", "email", or "user_login".
   • Check for internal file paths or configuration details if the action is related to settings.

6. Test Data Setup

To demonstrate information exposure, there must be "sensitive" data to expose:

1. Create a Registered User:

   wp user create victim victim@example.com --role=author --user_pass=password123
   

2. Post a Message as the User:
   • Log in as victim and post a message to the chat via the UI or by simulating the sac_post_message AJAX action.
   • Ensure the message is stored in the database with the user's IP (usually 127.0.0.1 in the test environment).
3. Confirm Database Entry:

   wp db query "SELECT * FROM wp_simple_ajax_chat LIMIT 5;"
   

7. Expected Results

A successful exploit will return a response (likely JSON) containing:

• The IP addresses of users who posted messages.
• User IDs or email addresses associated with chat messages.
• Potentially hidden chat room names or configuration keys.

8. Verification Steps

1. Compare Response to DB: Verify that the IP address or Email found in the HTTP response matches the data in the wp_simple_ajax_chat table.
2. Check Unauthenticated Access: Repeat the request without any WordPress session cookies to confirm that the nopriv hook is indeed leaking the data.

9. Alternative Approaches

If sac_get_messages does not leak data, investigate other nopriv actions identified in the source audit:

• Action Search: grep -r "wp_ajax_nopriv_" wp-content/plugins/simple-ajax-chat/
• Possible Candidates:
  • sac_export_messages: Might lack permission checks and return a CSV of all data.
  • sac_get_user_list: Might return a list of all chat participants including sensitive metadata.
  • Check if admin_init hooks are firing on admin-ajax.php without capability checks, which sometimes leads to configuration leakage.