Research Plan: CVE-2025-67575 (Sitewide Notice WP)

1. Vulnerability Summary

The Sitewide Notice WP plugin (versions <= 2.4.1) contains a Missing Authorization vulnerability. The flaw exists because the plugin registers a settings-update function to a hook that executes for unauthenticated users (likely admin_init or a wp_ajax_nopriv_* action) without implementing a current_user_can() check. This allows any network-level attacker to modify the plugin's configuration, including the global notice text and status, without being logged in.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php (if AJAX-based) or /wp-admin/admin-post.php (if using standard POST handlers).
• Vulnerable Action: The function is likely triggered by the snwp_save_settings or snw_update_options action (inferred).
• Parameters:
  • action: The registered hook name.
  • snwp_notice_text: The content of the notice (payload sink).
  • snwp_notice_status: Toggle for enabling/disabling the notice.
• Authentication: Unauthenticated (PR:N).
• Preconditions: The plugin must be active.

3. Code Flow (Inferred)

1. Registration: The plugin uses add_action( 'admin_init', 'snw_save_settings_function' ).
2. Execution: Since admin_init fires on admin-ajax.php and admin-post.php regardless of authentication, the function runs.
3. Missing Check: The function snw_save_settings_function checks if specific $_POST keys are present but fails to verify current_user_can( 'manage_options' ).
4. Sink: The function calls update_option( 'snw_settings_data', $_POST[...] ), persisting the attacker's input to the database.

4. Nonce Acquisition Strategy

Missing Authorization often accompanies Missing Nonce Verification. However, if a nonce is required, it must be obtainable by unauthenticated users for the exploit to succeed.

1. Identify Nonce Exposure: Check the main plugin file for wp_localize_script. Look for localization keys like snw_ajax_obj or sitewide_notice_data.
2. Locate Trigger Shortcode: Search for add_shortcode in the plugin source.
3. Setup:
   • wp post create --post_type=page --post_status=publish --post_title="Notice Test" --post_content="[sitewide_notice_shortcode]" (inferred).
4. Extraction:
   • Navigate to the newly created page using browser_navigate.
   • Use browser_eval to find the nonce: window.snw_ajax_obj?.nonce or window.sitewide_notice_data?.update_nonce (inferred).

5. Exploitation Strategy

Using the http_request tool, send a crafted POST request to the AJAX endpoint.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Payload:

  action=snwp_save_settings&snwp_notice_status=1&snwp_notice_text=Vulnerable+Site&_wpnonce=[EXTRACTED_NONCE]
  

  (Note: If _wpnonce is not verified due to the "Missing Authorization" nature, it can be omitted or set to any value.)

6. Test Data Setup

1. Install Sitewide Notice WP 2.4.1.
2. Activate the plugin.
3. Identify the exact option name used by the plugin: grep -r "update_option" .
4. Identify the exact action name: grep -r "wp_ajax_" . or grep -r "admin_init" .

7. Expected Results

• The http_request should return a 200 OK or a 302 Redirect (if using admin-post.php).
• The site frontend should now display the notice "Vulnerable Site" on every page.

8. Verification Steps

After the exploit, verify the database state via WP-CLI:

wp option get snw_settings_data

Confirm the notice_text field contains the string "Vulnerable Site".

9. Alternative Approaches

• Settings API Bypass: If the plugin uses register_setting, it may be possible to update options by targeting options.php directly if the option_group is known.
• REST API: Check grep -r "register_rest_route" . for any endpoints lacking a permission_callback.
• XSS Escalation: If snwp_notice_text is rendered without escaping (e.g., echo $notice), the vulnerability can be escalated to Stored XSS:
  snwp_notice_text=<script>alert(document.domain)</script>