Exploitation Research Plan: CVE-2026-4326 - Vertex Addons for Elementor

1. Vulnerability Summary

The Vertex Addons for Elementor plugin (versions <= 1.6.4) contains a missing authorization vulnerability in its AJAX handler for plugin activation. The function AFEB\Ajax::activate_required_plugins() performs a capability check using current_user_can('install_plugins'), but fails to exit or return when the check evaluates to false. Instead, it merely assigns an error message to a variable and continues to the plugin installation and activation logic. This allows any authenticated user (including those with Subscriber privileges) to install and activate arbitrary plugins from the WordPress.org repository.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: afeb_activate_required_plugins
• Required Authentication: Any logged-in user (Subscriber and above).
• Vulnerable Parameter: Likely slug or plugin (the slug of the WordPress.org plugin to install).
• Preconditions:
  • The plugin Vertex Addons for Elementor must be active.
  • Elementor must be active (the Ajax class is initialized only after elementor/loaded in afeb.php).

3. Code Flow

1. Initialization: In afeb.php, Vertex_Addons_For_Elementor::init() is called on the elementor/loaded hook.
2. Ajax Registration: init() calls (new Ajax())->init();. Inside app/Ajax.php, the init() method calls actions().
3. Hook Registration: Ajax::actions() registers the vulnerable hook:
   add_action('wp_ajax_afeb_activate_required_plugins', [$this, 'activate_required_plugins']);
4. Vulnerability Sink: The activate_required_plugins function is called.
   • It verifies the nonce: check_ajax_referer('afeb_ajax_nonce', 'nonce');.
   • It checks current_user_can('install_plugins').
   • The Bug: If the check fails, it populates an error variable but does not call wp_die() or return.
   • It proceeds to use Plugin_Upgrader or a similar WordPress core utility to install and activate the plugin provided in the $_POST data.
   • The error response is only sent at the very end of the function.

4. Nonce Acquisition Strategy

The endpoint requires a nonce tied to the action afeb_ajax_nonce. This nonce is localized for administrative screens.

1. Identify Localization: In app/Assets.php, the backend_script() function enqueues afeb-backend-script and calls $this->localize_script($handle).
2. Access Backend: Since Subscribers can access the WordPress dashboard (/wp-admin/index.php), the admin_enqueue_scripts hook will fire for them.
3. Extraction:
   • Login as a Subscriber.
   • Navigate to /wp-admin/.
   • The localized data is likely attached to a global JavaScript object named afeb_admin or afeb_backend (inferred from the plugin prefix afeb).
   • Use browser_eval to extract it: window.afeb_admin?.nonce or window.afeb_backend?.nonce.

5. Exploitation Strategy

We will attempt to install and activate the hello-dolly plugin (a benign, standard plugin) to prove the vulnerability.

Step-by-Step Plan:

1. Login: Authenticate as a Subscriber-level user.
2. Extract Nonce:
   • Navigate to /wp-admin/.
   • Execute browser_eval("afeb_admin.nonce") to retrieve the afeb_ajax_nonce. (If afeb_admin is not found, inspect the page source for wp_localize_script outputs).
3. Execute Exploit:
   • Send a POST request to admin-ajax.php.
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=afeb_activate_required_plugins&nonce=[EXTRACTED_NONCE]&slug=hello-dolly
     

   • Note: If slug does not work, try plugin=hello-dolly.

6. Test Data Setup

1. Roles: Ensure a user with the subscriber role exists.
2. Plugins:
   • Install elementor (required for Vertex Addons to load).
   • Install addons-for-elementor-builder version 1.6.4.
3. Activation: Activate both plugins via WP-CLI.

7. Expected Results

• Response: Even if the response returns a JSON error like {"success":false,"data":{"message":"You do not have permission..."}}, the plugin installation should have already occurred.
• State Change: The hello-dolly plugin should be present in the wp-content/plugins directory and marked as "Active" in the database.

8. Verification Steps

After sending the HTTP request, use WP-CLI to confirm the installation:

wp plugin is-installed hello-dolly
wp plugin status hello-dolly

Successful exploitation is confirmed if the status is Active.

9. Alternative Approaches

If the afeb_activate_required_plugins function expects an array of plugins:

• Payload: action=afeb_activate_required_plugins&nonce=[NONCE]&plugins[]=hello-dolly
• Payload: action=afeb_activate_required_plugins&nonce=[NONCE]&slugs[]=hello-dolly

If the nonce is not found on the dashboard, check the Elementor editor page (if the Subscriber has access to any post):

• Navigate to /wp-admin/post.php?post=[ID]&action=elementor.
• Check for afeb related localized scripts there.