UpsellWP <= 2.2.3 - Missing Authorization

Since the source code for version 2.2.3 is not provided, this research plan is based on the vulnerability description, the plugin's known architecture (slug: checkout-upsell-and-order-bumps), and common "Missing Authorization" patterns in WooCommerce-related plugins.

1. Vulnerability Summary

The UpsellWP plugin (<= 2.2.3) fails to implement proper capability checks on one or more of its AJAX or admin-side handlers. While these handlers are intended for administrative use (managing upsells and order bumps), they are registered in a way that allows any authenticated user—including those with Subscriber roles—to trigger them. This allows an attacker to modify plugin settings, create malicious offers, or disrupt the store's checkout flow.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: Likely upsell_wp_save_settings, upsell_wp_update_offer, or upsell_wp_toggle_offer_status (inferred).
• Authentication: Authenticated (Subscriber or higher).
• Payload Parameter: action, nonce (if checked), and data parameters (e.g., settings_data or offer_id).
• Preconditions: The attacker must have a valid Subscriber-level session cookie.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an AJAX action in its main class or an admin-specific class:

   add_action( 'wp_ajax_upsell_wp_save_settings', [ $this, 'save_settings_callback' ] );
   

2. Missing Check: Inside save_settings_callback, the code likely performs a nonce check but fails to call current_user_can( 'manage_options' ).
3. Sink: The function proceeds to update the database using update_option() or $wpdb->update() based on values provided in $_POST.

4. Nonce Acquisition Strategy

Many WooCommerce plugins localize nonces for the admin dashboard. Since Subscribers can access wp-admin/profile.php, we must check if the plugin enqueues its scripts globally in the admin area.

1. Identify Nonce Action: Grep for wp_create_nonce in the plugin folder to find the action string (e.g., upsell-wp-nonce).
2. Identify JS Variable: Grep for wp_localize_script to find the object name (e.g., upsell_wp_vars).
3. Extraction:
   • Create a Subscriber user and log in.
   • Navigate to wp-admin/profile.php.
   • Use browser_eval to extract the nonce:
     browser_eval("window.upsell_wp_vars?.nonce") (inferred name).
4. Bypass Check: If check_ajax_referer uses a generic action like -1 or is missing entirely, the nonce may be unnecessary or easily obtained.

5. Exploitation Strategy

We will attempt to disable an existing order bump or change a global setting to demonstrate unauthorized modification.

Step 1: Identify Target Setting
Use WP-CLI to find current settings:
wp option get upsell_wp_settings (inferred name).

Step 2: Prepare Payload
We will target an action like saving settings.

• Request Method: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: upsell_wp_save_settings (inferred)
  • upsell_wp_nonce: [EXTRACTED_NONCE]
  • settings: {"enable_upsells":"0"} (example payload to disable the plugin's main feature)

Step 3: Execute via http_request
Using the Subscriber's cookies.

6. Test Data Setup

1. Plugin Setup: Install UpsellWP 2.2.3 and WooCommerce.
2. Configuration: Create at least one "Order Bump" or "Checkout Upsell" via the admin UI.
3. Attacker User:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
   

4. Confirm Target State:

   wp option get upsell_wp_settings
   

7. Expected Results

• HTTP Response: The server should return a 200 OK with a success indicator (e.g., {"success":true} or 1).
• Impact: The targeted setting (e.g., enable_upsells) should be modified in the database despite the request coming from a Subscriber.

8. Verification Steps

After sending the HTTP request, verify the change using WP-CLI:

# Verify the option value has changed
wp option get upsell_wp_settings

# Or verify via database directly if options are serialized
wp db query "SELECT option_value FROM wp_options WHERE option_name = 'upsell_wp_settings'"

9. Alternative Approaches

If upsell_wp_save_settings is not the vulnerable action, the researcher should use the following commands to find other candidates:

1. List all AJAX actions registered by the plugin:

   grep -r "wp_ajax_" wp-content/plugins/checkout-upsell-and-order-bumps/
   

2. Analyze the callbacks for those actions:
   Search for callbacks that DO NOT contain the string current_user_can.

   # Example: Check if the 'save_offer' function has auth checks
   grep -A 15 "function save_offer" wp-content/plugins/checkout-upsell-and-order-bumps/path/to/file.php
   

3. Check admin_init hooks:
   Some plugins handle form submissions via admin_init. Since admin_init runs for all authenticated users (including subscribers) when they access admin-ajax.php or admin-post.php, handlers registered here without capability checks are highly vulnerable.

   grep -r "add_action.*admin_init" wp-content/plugins/checkout-upsell-and-order-bumps/