[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFwbxJfvKGFwAf8_8MkRM9XoHEpPDtSXK0J6eFBW0ynQ":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":30,"research_started_at":31,"research_completed_at":32,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":33},"CVE-2026-11426","underconstructionpage-pro-authenticated-subscriber-arbitrary-file-read-via-templatethumbnail-parameter","UnderConstructionPage PRO \u003C= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter","The UnderConstructionPage PRO plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.76. This is due to the plugin accepting arbitrary local file paths in the template_thumbnail parameter and copying their contents into a publicly accessible uploads file. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary files on the server, which can contain sensitive information.","under-construction-page",null,"\u003C=5.76","5.81","medium",6.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","2026-07-10 13:21:10","2026-07-11 01:29:22",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F29dff562-e9b0-4cc9-b974-9239fbf0310f?source=api-prod",1,[22,23,24,25],"css\u002Fucp-admin.css","js\u002Fucp-admin.js","readme.txt","under-construction.php","researched",false,3,"This research plan targets a Path Traversal vulnerability in the **UnderConstructionPage PRO** plugin (\u003C= 5.76). The vulnerability allows a Subscriber-level user to read arbitrary files (e.g., `wp-config.php`, `\u002Fetc\u002Fpasswd`) by leveraging a template installation or preview feature that improperly handles the `template_thumbnail` parameter.\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Authenticated Arbitrary File Read (Path Traversal)\n*   **Affected Parameter:** `template_thumbnail`\n*   **Sink Function:** Likely `file_get_contents()`, `copy()`, or `curl`-based logic that fails to validate if the \"URL\" provided is actually a local file path.\n*   **Mechanism:** The plugin takes a path\u002FURL from the user, reads its content, and saves it to a publicly accessible location within the `wp-content\u002Fuploads\u002F` directory, intended for template thumbnails.\n*   **Auth Level:** Subscriber or higher. This indicates a failure in capability checking (`current_user_can`) within an AJAX or Admin Action handler.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `wp-admin\u002Fadmin-ajax.php`\n*   **Action:** `ucp_install_template` (inferred from PRO template handling) or a similar action related to template selection.\n*   **Vulnerable Parameter:** `template_thumbnail`\n*   **Preconditions:** \n    *   Plugin UnderConstructionPage PRO installed and active (version \u003C= 5.76).\n    *   Valid credentials for a Subscriber-level user.\n\n### 3. Code Flow (Inferred from PRO behavior)\n1.  **Entry Point:** The plugin registers an AJAX action for template management, e.g., `add_action('wp_ajax_ucp_install_template', ...)` without a strict capability check.\n2.  **Input:** The handler receives `$_POST['template_thumbnail']`.\n3.  **Traversal:** The attacker provides a local path like `..\u002F..\u002F..\u002F..\u002Fwp-config.php`.\n4.  **The Sink:** The code performs an operation like:\n    `$thumb_data = file_get_contents($_POST['template_thumbnail']);`\n    `file_put_contents($upload_dir . '\u002Ftemp_thumb.jpg', $thumb_data);`\n5.  **Exfiltration:** The attacker accesses the file via `http:\u002F\u002Fsite.com\u002Fwp-content\u002Fuploads\u002Funder-construction-page\u002Ftemp_thumb.jpg`.\n\n### 4. Nonce Acquisition Strategy\nThe plugin localizes data into a JavaScript object named `ucp`. We need the nonce associated with template installation.\n\n1.  **Login:** Log in as a Subscriber user.\n2.  **Navigation:** Navigate to the WordPress dashboard (`\u002Fwp-admin\u002F`).\n3.  **Discovery:** Use `browser_eval` to inspect the `ucp` object.\n    *   **Script Variable:** `window.ucp`\n    *   **Potential Nonce Keys:** `nonce_install_template`, `nonce_activate_theme`, or `nonce_save_settings`.\n    *   **Command:** `browser_eval(\"window.ucp\")`\n\n### 5. Exploitation Strategy\n\n#### Step 1: Authentication & Nonce Extraction\n*   Log in as Subscriber.\n*   Run: `browser_eval(\"window.ucp.nonce_install_template\")` (or the identified key).\n\n#### Step 2: Trigger File Read via AJAX\n*   **Method:** POST to `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Action:** `ucp_install_template`\n*   **Payload:**\n    *   `action`: `ucp_install_template`\n    *   `_ajax_nonce`: `[EXTRACTED_NONCE]`\n    *   `template_thumbnail`: `..\u002F..\u002F..\u002F..\u002Fwp-config.php`\n    *   `theme_id`: `1` (or any valid ID)\n*   **Tool:** `http_request`\n\n#### Step 3: Access the Copied File\n*   The file is likely moved to a predictable path. Based on plugin behavior, check:\n    *   `[WP_URL]\u002Fwp-content\u002Fuploads\u002Funder-construction-page\u002Ftemp-thumb.jpg`\n    *   `[WP_URL]\u002Fwp-content\u002Fuploads\u002Fucp-templates\u002Fthumbnails\u002Ftemp.jpg`\n\n### 6. Test Data Setup\n1.  **Install Target:** Install UnderConstructionPage PRO v5.76.\n2.  **User Creation:** \n    `wp user create attacker attacker@example.com --role=subscriber --user_pass=password123`\n3.  **Plugin Config:** Ensure the plugin is active. If the \"Templates\" tab is only visible to admins, the AJAX action must be tested directly as the Subscriber user to confirm missing capability checks.\n\n### 7. Expected Results\n*   The AJAX request returns a `success: true` or a JSON response indicating the \"template\" was processed.\n*   The file at the destination URL (in uploads) contains the cleartext PHP\u002Fconfiguration of the target file.\n\n### 8. Verification Steps\n1.  **Verification (CLI):** Check if the file was created in the uploads folder:\n    `ls -la \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fuploads\u002Funder-construction-page\u002F`\n2.  **Content Check:** Compare the MD5 hash of the original `wp-config.php` and the \"thumbnail\" file:\n    `md5sum \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-config.php`\n    `md5sum \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fuploads\u002Funder-construction-page\u002Ftemp-thumb.jpg`\n\n### 9. Alternative Approaches\nIf `ucp_install_template` is not the correct action:\n1.  **Grep for Sinks:** In the local environment, search the PRO plugin folder for `file_get_contents` or `copy` combined with `$_POST` or `$_GET`.\n    `grep -rnE \"file_get_contents|copy|download_url\" . | grep \"\\[\"`\n2.  **Template Preview:** Check if there is a \"Preview\" feature for templates that accepts a thumbnail URL.\n3.  **Settings Save:** If the plugin saves the `template_thumbnail` into options via `register_setting`, try sending the payload during a standard settings update if the Subscriber has access to `admin-post.php` or `options.php` handlers.","gemini-3-flash-preview","2026-07-15 09:50:00","2026-07-15 09:51:04",{"type":34,"vulnerable_version":35,"fixed_version":11,"vulnerable_browse":36,"vulnerable_zip":37,"fixed_browse":38,"fixed_zip":39,"all_tags":40},"plugin","4.05","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Funder-construction-page\u002Ftags\u002F4.05","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Funder-construction-page.4.05.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Funder-construction-page\u002Ftags\u002F5.81","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Funder-construction-page.5.81.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Funder-construction-page\u002Ftags"]