Tasty Recipes Lite <= 1.1.5 - Missing Authorization

This research plan outlines the process for identifying and exploiting a missing authorization vulnerability (CVE-2025-62131) in the Tasty Recipes Lite plugin (<= 1.1.5).

---

1. Vulnerability Summary

The Tasty Recipes Lite plugin fails to perform a capability check (e.g., current_user_can( 'manage_options' )) in one or more of its AJAX handlers. While these handlers may verify a WordPress nonce (protecting against CSRF), they do not verify that the authenticated user has the required permissions to execute the action. This allows any authenticated user, including those with Subscriber roles, to trigger administrative or restricted functionality.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Method: POST
• Action: To be determined via code audit (likely prefixed with tasty_recipes_lite_).
• Payload Parameters: action, _wpnonce (if required), and specific data parameters (e.g., option_name, value, recipe_id).
• Authentication: Authenticated (Subscriber-level or higher).
• Preconditions: The plugin must be active. The attacker must have a valid session cookie for a Subscriber-level user.

3. Code Flow

1. Registration: The plugin registers AJAX handlers during the init or admin_init hook using add_action( 'wp_ajax_{action_name}', ... ).
2. Entry Point: An authenticated user sends a request to admin-ajax.php with the corresponding action.
3. Callback Execution: WordPress executes the registered callback function.
4. Vulnerable Code: Inside the callback:
   • The code may call check_ajax_referer( 'some_action', 'security' ) or wp_verify_nonce().
   • Crucially, it fails to call current_user_can().
5. Sink: The function proceeds to perform a state-changing operation, such as updating an option via update_option(), deleting metadata, or modifying recipe settings.

4. Nonce Acquisition Strategy

If the vulnerable function requires a nonce, it is likely localized for the WordPress admin dashboard, which is accessible to Subscribers (via wp-admin/profile.php or the dashboard).

1. Identify Localized Data: Search the codebase for wp_localize_script. Look for handles like tasty-recipes-lite-admin or similar.
   • Search Command: grep -r "wp_localize_script" .
2. Find the Nonce Key: Locate the action string and the variable name (e.g., window.tastyRecipesLiteAdmin?.nonce).
3. Extraction via Browser:
   • Log in as a Subscriber.
   • Navigate to the WordPress dashboard: browser_navigate("/wp-admin/index.php").
   • Use browser_eval to extract the nonce:

     // Example (adjust based on actual JS variable found)
     window.tasty_recipes_lite_admin_params?.nonce 
     

5. Exploitation Strategy

The goal is to modify a plugin setting or perform an unauthorized action as a Subscriber.

1. Code Audit (Discovery Phase):

   • List all AJAX handlers: grep -rn "wp_ajax_" .
   • For each handler, check the callback function for a current_user_can call.
   • Identify handlers that perform sensitive operations (e.g., update_option, delete_post).
   • Hypothetical Target: tasty_recipes_lite_save_settings.

2. Craft the Request:

   • URL: http://localhost:8080/wp-admin/admin-ajax.php
   • Headers: Content-Type: application/x-www-form-urlencoded, Cookie: [Subscriber Cookies]
   • Body:

     action=[VULNERABLE_ACTION]&_wpnonce=[EXTRACTED_NONCE]&[PARAM_NAME]=[MALICIOUS_VALUE]
     

3. Execution: Use http_request to send the payload.

6. Test Data Setup

1. Install Plugin: Ensure tasty-recipes-lite version 1.1.5 is installed and active.
2. Create User: Create a Subscriber user.
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password
3. Plugin State: Configure at least one recipe or setting that can be modified to verify the exploit.
   • wp post create --post_type=recipe --post_title="Target Recipe" --post_status=publish (Note: Custom post types might vary).

7. Expected Results

• Successful Exploitation: The server returns a success response (e.g., 200 OK or {"success": true}).
• Unauthorized Action: A setting is changed, data is deleted, or a restricted function is executed that should be reserved for Administrators.
• Evidence: The Subscriber user can influence the global state of the plugin.

8. Verification Steps

1. Database Check: Use WP-CLI to verify if the targeted change persisted.
   • wp option get [modified_option_name]
   • wp post list --post_type=recipe (to check for deletions or modifications).
2. UI Check: Navigate to the plugin settings page as an Administrator to see if the values have been altered.

9. Alternative Approaches

• Notice Dismissal: Check if the vulnerability exists in a "dismiss notice" handler. While lower impact, it confirms the Missing Authorization pattern.
• REST API: Check if the plugin registers REST routes via register_rest_route. If the permission_callback returns __return_true or uses is_user_logged_in() instead of a capability check, it is also vulnerable.
  • Search Command: grep -rn "register_rest_route" . -A 5
• Parameter Fuzzing: If the AJAX callback uses $_POST or $_REQUEST dynamically to update options, attempt to update core WordPress options like default_role to administrator (though usually, plugins prefix their options).