[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fS_GqM3na7ZdxnqJRsglj8t1ots0Fjuf5TMWHwz7ot8A":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-1832","thrivedesk-missing-authorization-to-authenticated-subscriber-cache-deletion","ThriveDesk \u003C= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion","The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is vulnerable to unauthorized cache deletion due to a missing capability check on the 'thrivedesk_clear_cache' AJAX action in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear the plugin's cache.","thrivedesk",null,"\u003C=2.1.7","2.2.0","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-10 15:36:28","2026-07-11 03:44:25",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fec4bc1d4-2f14-4f3e-85ed-8737c56f905c?source=api-prod",1,[22,23,24,25,26,27,28,29],"assets\u002Fcss\u002Fadmin.css","assets\u002Fcss\u002Fthrivedesk.css","assets\u002Fjs\u002Fadmin.js","assets\u002Fjs\u002Fadmin.js.LICENSE.txt","assets\u002Fjs\u002Fconversation.js","assets\u002Fjs\u002Fwp-scripts\u002Fthrivedesk-autonami-tab.asset.php","assets\u002Fjs\u002Fwp-scripts\u002Fthrivedesk-autonami-tab.js","assets\u002Fmix-manifest.json","researched",false,3,"This research plan outlines the steps required to demonstrate the missing authorization vulnerability in the ThriveDesk plugin, allowing a Subscriber-level user to clear the plugin's cache.\n\n### 1. Vulnerability Summary\nThe ThriveDesk plugin for WordPress (versions \u003C= 2.1.7) fails to perform a capability check (e.g., `current_user_can( 'manage_options' )`) in the handler for the `thrivedesk_clear_cache` AJAX action. While the plugin may implement nonce verification, the nonce is often exposed to all authenticated users in the WordPress admin dashboard (e.g., via script localization on the `profile.php` page). Consequently, any authenticated user with at least Subscriber-level permissions can trigger the cache deletion functionality.\n\n### 2. Attack Vector Analysis\n*   **Endpoint**: `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Action**: `thrivedesk_clear_cache`\n*   **Method**: POST\n*   **Parameters**:\n    *   `action`: `thrivedesk_clear_cache`\n    *   `_nonce` or `nonce` (inferred): The security token for the request.\n*   **Required Authentication**: Subscriber-level account (PR:L).\n*   **Preconditions**: The plugin must be active and the Subscriber user must be able to access the WordPress backend (standard for WordPress sites unless explicitly disabled).\n\n### 3. Code Flow (Inferred)\n1.  **Registration**: The plugin registers the AJAX action during initialization:\n    `add_action( 'wp_ajax_thrivedesk_clear_cache', 'thrivedesk_clear_cache_handler' );`\n2.  **Trigger**: An authenticated user sends a POST request to `admin-ajax.php` with `action=thrivedesk_clear_cache`.\n3.  **Vulnerable Handler**: The handler function (likely `thrivedesk_clear_cache_handler`) is called. It may check a nonce using `check_ajax_referer` or `wp_verify_nonce`, but it fails to check if the user has administrative privileges.\n4.  **Sink**: The handler calls the internal clearing function (e.g., clearing transients or database options) and returns a success response.\n\n### 4. Nonce Acquisition Strategy\nBecause the source files provided are primarily CSS and bundled JS, the exact nonce variable name must be identified dynamically. Most WordPress plugins localize their data into a global window object.\n\n1.  **Identify the variable**: Search for where ThriveDesk localizes its script data.\n    *   **Command**: `grep -rn \"wp_localize_script\" .` in the plugin directory.\n    *   **Expected identifiers**: Look for `td_nonce`, `thrivedesk`, or `thrivedesk_admin_options`.\n2.  **Acquisition Flow**:\n    *   Log in as a **Subscriber**.\n    *   Navigate to `\u002Fwp-admin\u002Fprofile.php`.\n    *   Use `browser_eval` to find the ThriveDesk object and its nonce.\n    *   **Probable JS Path**: `window.thrivedesk?.nonce` or `window.td_admin?.nonce`.\n\n### 5. Exploitation Strategy\n1.  **Preparation**:\n    *   Log in as a Subscriber using the `http_request` or `browser_navigate` tool.\n2.  **Nonce Extraction**:\n    *   Navigate to the WordPress dashboard (Subscriber view).\n    *   Execute JS to find the nonce:\n        ```javascript\n        \u002F\u002F Example search for the nonce in the window object\n        Object.keys(window).find(key => key.includes('thrivedesk'));\n        ```\n3.  **Execution**:\n    *   Construct a POST request to `admin-ajax.php`.\n    *   **URL**: `http:\u002F\u002F[target]\u002Fwp-admin\u002Fadmin-ajax.php`\n    *   **Body (URL-encoded)**:\n        *   `action=thrivedesk_clear_cache`\n        *   `_ajax_nonce=[EXTRACTED_NONCE]` (Note: The parameter name might be `nonce`, `_nonce`, or `td_nonce`).\n4.  **Capture Response**:\n    *   Verify the HTTP status is 200.\n    *   Look for a success indicator in the body: `{\"success\":true}` or `1`.\n\n### 6. Test Data Setup\n1.  **Plugin Installation**: Install and activate the ThriveDesk plugin (version 2.1.7).\n2.  **User Creation**: Create a user with the `subscriber` role.\n    *   `wp user create attacker attacker@example.com --role=subscriber --user_pass=password123`\n3.  **Cache Generation**: Ensure some plugin data is cached (e.g., by visiting ThriveDesk settings as an admin or interacting with the plugin if it caches API responses).\n\n### 7. Expected Results\n*   The Subscriber's request to `thrivedesk_clear_cache` should be accepted.\n*   The server response should indicate success (e.g., JSON `{\"success\":true}`).\n*   The plugin's cache\u002Ftransients should be removed.\n\n### 8. Verification Steps\n1.  **Manual Check**: Before running the exploit, check if specific ThriveDesk transients exist in the database.\n    *   `wp transient list --search=\"thrivedesk*\"`\n2.  **Post-Exploit Check**: After the Subscriber request, verify the transients are gone.\n    *   `wp transient list --search=\"thrivedesk*\"`\n3.  **Response Analysis**: Confirm the response was not a 403 Forbidden or a `0` (which typically indicates a failed AJAX registration or auth failure in WordPress).\n\n### 9. Alternative Approaches\n*   **REST API**: Check if a similar endpoint exists via the REST API (referencing `assets\u002Fjs\u002Fwp-scripts\u002Fthrivedesk-autonami-tab.js` which uses `wp-api-fetch`).\n    *   Check for routes like `thrivedesk\u002Fv1\u002Fcache\u002Fclear`.\n*   **Nonce-less Attempt**: If the `grep` search for `check_ajax_referer` in the plugin's PHP files returns no results, try the request without a nonce parameter to confirm if verification is missing entirely.","The ThriveDesk plugin for WordPress fails to perform a capability check in its 'thrivedesk_clear_cache' AJAX handler in versions up to 2.1.7. This allows any authenticated user, including those with low-level Subscriber permissions, to clear the plugin's internal cache by sending a crafted AJAX request.","\u002F\u002F File path: thrivedesk.php (or similar main plugin\u002FAJAX handler file)\n\u002F\u002F Line numbers inferred from common WordPress AJAX registration patterns\n\nadd_action( 'wp_ajax_thrivedesk_clear_cache', 'thrivedesk_clear_cache_handler' );\n\nfunction thrivedesk_clear_cache_handler() {\n    \u002F\u002F The vulnerability exists here because there is no check for user capabilities \n    \u002F\u002F like current_user_can( 'manage_options' ) before performing the action.\n    \n    thrivedesk_options_cache_clear();\n    wp_send_json_success();\n}","--- a\u002Fthrivedesk.php\n+++ b\u002Fthrivedesk.php\n@@ -100,6 +100,10 @@\n function thrivedesk_clear_cache_handler() {\n+    if ( ! current_user_can( 'manage_options' ) ) {\n+        wp_send_json_error( array( 'message' => 'Unauthorized' ), 403 );\n+    }\n+\n+    check_ajax_referer( 'thrivedesk_nonce', 'nonce' );\n+\n     thrivedesk_options_cache_clear();\n     wp_send_json_success();\n }","To exploit this vulnerability, an attacker first authenticates as a Subscriber-level user and navigates to the WordPress admin dashboard (e.g., \u002Fwp-admin\u002Fprofile.php). From the page source or the global JavaScript 'window' object, the attacker extracts a valid nonce associated with ThriveDesk (often localized via wp_localize_script). The attacker then sends an AJAX POST request to '\u002Fwp-admin\u002Fadmin-ajax.php' with the 'action' parameter set to 'thrivedesk_clear_cache' and the extracted nonce. Because the server-side handler lacks a 'current_user_can' check, the plugin clears its cache and returns a success response to the unauthorized user.","gemini-3-flash-preview","2026-07-15 08:47:28","2026-07-15 08:47:51",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","2.1.7","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fthrivedesk\u002Ftags\u002F2.1.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fthrivedesk.2.1.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fthrivedesk\u002Ftags\u002F2.2.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fthrivedesk.2.2.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fthrivedesk\u002Ftags"]