[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feBi68cdMJgO_DRKQJzZLBFTj1lbHE71RqjYAuWNL7qw":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-12385","smart-slider-3-missing-authorization-to-authenticated-contributor-sensitive-information-exposure-via-wpquery-parameter-i","Smart Slider 3 \u003C= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter","The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles and full content excerpts of private, draft, pending, trashed, and auto-draft posts authored by any user, including Administrators and Editors. The required nonce is emitted on \u002Fwp-admin\u002Fpost-new.php, which is accessible to Contributor-level users via the edit_posts capability, meaning any Contributor can obtain the nonce needed to trigger the injection.","smart-slider-3",null,"\u003C=3.5.1.37","3.5.1.38","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Exposure of Sensitive Information to an Unauthorized Actor","2026-07-13 06:13:11","2026-07-13 19:33:57",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fa782d975-74ce-4265-9312-435b3585a5c6?source=api-prod",1,[22,23,24,25,26,27,28,29],"Nextend\u002FFramework\u002FContent\u002FControllerAjaxContent.php","Nextend\u002FFramework\u002FContent\u002FWordPress\u002FWordPressContent.php","Nextend\u002FFramework\u002FFont\u002FSources\u002FGoogleFonts\u002Ffamilies.csv","Nextend\u002FSmartSlider3\u002FSmartSlider3Info.php","Public\u002FSmartSlider3\u002FApplication\u002FAdmin\u002FAssets\u002Fdist\u002Fsmartslider-backend.min.js","Public\u002FSmartSlider3\u002FApplication\u002FFrontend\u002FAssets\u002Fdist\u002Fiframe.min.js","Public\u002FSmartSlider3\u002FApplication\u002FFrontend\u002FAssets\u002Fdist\u002Fn2.min.js","Public\u002FSmartSlider3\u002FApplication\u002FFrontend\u002FAssets\u002Fdist\u002Fsmartslider-frontend.min.js","researched",false,3,"# Exploitation Research Plan - CVE-2026-12385\n\n## 1. Vulnerability Summary\nThe **Smart Slider 3** plugin (up to version 3.5.1.37) is vulnerable to **Sensitive Information Exposure** via a `WP_Query` parameter injection. The vulnerability exists because the `keyword` parameter provided to AJAX search actions is concatenated directly into a query string used to instantiate a `WP_Query` object. Since `WP_Query` parses string inputs similar to URL query strings, an attacker can inject additional parameters (separated by `&`) to override hardcoded constraints like `post_status=publish`. This allows authenticated users with `Contributor` permissions to retrieve the titles and excerpts of private, draft, or trashed posts authored by any user.\n\n## 2. Attack Vector Analysis\n- **Target Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **AJAX Action:** `nextend-smartslider3` (via the Nextend Framework's AJAX routing).\n- **Vulnerable Parameters:**\n    - `nextendcontroller`: `content`\n    - `nextendaction`: `SearchContent` (or `SearchLink`)\n    - **`keyword`**: The injection point.\n- **Authentication:** Authenticated (Contributor level or higher).\n- **Preconditions:** The attacker must obtain a valid Nextend security token (nonce).\n\n## 3. Code Flow\n1. **Entry Point:** A request is sent to `admin-ajax.php?action=nextend-smartslider3`.\n2. **Routing:** The Nextend framework routes this to `Nextend\\Framework\\Content\\ControllerAjaxContent`.\n3. **Controller Logic:** In `ControllerAjaxContent.php`, the method `actionSearchContent()` is called:\n   - It calls `$this->validateToken()` to verify the nonce.\n   - It retrieves `$keyword` from `Request::$REQUEST->getVar('keyword', '')`.\n   - It calls `Content::searchContent($keyword)`.\n4. **Sink:** In `Nextend\\Framework\\Content\\WordPress\\WordPressContent.php`, the `searchContent($keyword)` method is executed:\n   - It constructs a query string: `'post_type=any&posts_per_page=20&post_status=publish&s=' . $keyword`.\n   - It passes this string to `new WP_Query(...)`.\n5. **Injection:** If `$keyword` is set to `&post_status=any`, the resulting string is `post_type=any&posts_per_page=20&post_status=publish&s=&post_status=any`.\n6. **Execution:** `WP_Query` parses this string. When duplicate keys exist in a query string, the later values typically override earlier ones. Thus, `post_status` becomes `any`, causing the query to return non-public posts.\n\n## 4. Nonce Acquisition Strategy\nThe plugin emits the required security token (nonce) on pages where the Smart Slider editor interface or post-insertion tools are loaded. Per the vulnerability description, this occurs on `\u002Fwp-admin\u002Fpost-new.php`.\n\n**Strategy:**\n1. Log in as a **Contributor**.\n2. Navigate to `http:\u002F\u002F\u003CTARGET>\u002Fwp-admin\u002Fpost-new.php`.\n3. The token is typically localized in a global JavaScript object named `nextend` or passed via `wp_localize_script`.\n4. Use `browser_eval` to find the token:\n   - **Target Variable:** `window.nextend.token` (or `window.N2Wordpress.token`).\n   - Based on Nextend framework history, the key is often stored in `window.nextend.token`.\n\n## 5. Exploitation Strategy\n### Step 1: Authentication & Nonce Extraction\n1. Use `http_request` to log in as a Contributor.\n2. Use `browser_navigate` to go to `\u002Fwp-admin\u002Fpost-new.php`.\n3. Use `browser_eval` to extract the token:\n   ```javascript\n   window.nextend?.token || \"Not Found\"\n   ```\n\n### Step 2: Sensitive Information Extraction\nPerform a POST request to `admin-ajax.php` injecting the `post_status` parameter.\n\n- **URL:** `http:\u002F\u002F\u003CTARGET>\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Method:** `POST`\n- **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n- **Parameters:**\n    - `action`: `nextend-smartslider3`\n    - `nextendcontroller`: `content`\n    - `nextendaction`: `SearchContent`\n    - `n2token`: `[EXTRACTED_TOKEN]`\n    - `keyword`: `&post_status=any`\n\n### Step 3: Specific Post Retrieval (Targeted)\nTo leak the content of a specific private post (e.g., ID 1234):\n- **keyword**: `&p=1234&post_status=any`\n\n## 6. Test Data Setup\n1. **Administrator Actions:**\n   - Create a post with `post_status` set to `private`.\n   - Title: `SECRET_ADMIN_POST_TITLE`\n   - Content: `This is sensitive administrator information that contributors should not see.`\n2. **Contributor User:**\n   - Create a user with the `contributor` role.\n\n## 7. Expected Results\n- **Success:** The AJAX response (JSON) will contain an array of objects. One of these objects will have:\n    - `title`: `SECRET_ADMIN_POST_TITLE`\n    - `description`: The excerpt\u002Fcontent of the private post.\n    - `info`: `Post` (or the post type label).\n- **Failure:** The response returns only public posts or an error indicating an invalid token\u002Fpermissions.\n\n## 8. Verification Steps\n1. **Check Output:** Inspect the JSON response from the `http_request` tool to confirm the presence of the `SECRET_ADMIN_POST_TITLE`.\n2. **WP-CLI Verification:** Confirm the post's status is indeed private:\n   ```bash\n   wp post list --post_type=post --post_status=private --fields=ID,post_title\n   ```\n\n## 9. Alternative Approaches\n- **Action `SearchLink`:** If `SearchContent` is restricted, test `nextendaction=SearchLink`. It uses the same `WP_Query` logic but returns only titles and permalinks.\n- **Bypassing `s=`:** If the search term `s` interferes, try `keyword` as `&post_status=private&posts_per_page=-1` to list all private posts regardless of search relevance.\n- **Post Type Enumeration:** Inject `&post_type=page&post_status=draft` to find draft pages specifically.","gemini-3-flash-preview","2026-07-15 07:55:25","2026-07-15 07:56:20",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","3.5.1.37","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsmart-slider-3\u002Ftags\u002F3.5.1.37","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsmart-slider-3.3.5.1.37.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsmart-slider-3\u002Ftags\u002F3.5.1.38","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsmart-slider-3.3.5.1.38.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsmart-slider-3\u002Ftags"]