[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foBWUsZlIIgM2OBn2jYtnfLMiZOeUhaRIL_IjN1osxPU":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":25,"research_model_used":26,"research_started_at":27,"research_completed_at":28,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":29},"CVE-2026-39609","wava-payment-missing-authorization","Wava Payment \u003C= 0.3.7 - Missing Authorization","The Wava Payment plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 0.3.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.","wava-payment",null,"\u003C=0.3.7","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-02-07 00:00:00","2026-04-15 21:17:15",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F018fafb9-0e86-47b2-b747-04aab1c1d5e0?source=api-prod",[],"researched",false,3,"This plan outlines the steps to identify and exploit a missing authorization vulnerability (CVE-2026-39609) in the Wava Payment plugin for WordPress (\u003C= 0.3.7).\n\n### 1. Vulnerability Summary\nThe Wava Payment plugin fails to implement proper capability checks on sensitive functions, likely registered via WordPress AJAX handlers (`wp_ajax_` \u002F `wp_ajax_nopriv_`) or the `admin_init` hook. This allows unauthenticated attackers to perform actions intended for administrators, such as modifying plugin settings, changing payment configurations, or altering transaction records. The vulnerability exists because the developer relied on the function's intended use case (e.g., an admin dashboard) without verifying the current user's permissions via `current_user_can()`.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php` or any admin-init triggered path (like `\u002Fwp-admin\u002Fadmin-post.php`).\n*   **Vulnerable Action:** Likely an AJAX action registered with `wp_ajax_nopriv_` or an `admin_init` hook that processes `$_POST` data without authorization checks.\n*   **Authentication:** Unauthenticated (`PR:N`).\n*   **Payload:** A POST request containing the specific action name and parameters to overwrite plugin options or trigger sensitive logic.\n\n### 3. Code Flow (Inferred)\n1.  **Entry Point:** The plugin registers a hook in the main plugin file or an admin-specific class:\n    *   `add_action('admin_init', 'wava_payment_save_settings');` OR\n    *   `add_action('wp_ajax_nopriv_wava_update_config', 'wava_update_config_callback');`\n2.  **Processing:** The callback function (e.g., `wava_payment_save_settings`) is invoked during the WordPress initialization phase.\n3.  **Missing Check:** The function checks if specific `$_POST` parameters are set but fails to call `current_user_can('manage_options')`.\n4.  **Sink:** The function calls `update_option('wava_payment_settings', ...)` or directly modifies database records via `$wpdb`, using unvalidated input from `$_POST`.\n\n### 4. Nonce Acquisition Strategy\nWhile the vulnerability is \"Missing Authorization,\" it may still implement a CSRF check (nonce). If `check_ajax_referer` or `wp_verify_nonce` is present but the capability check is missing, the exploit requires a valid nonce.\n\n1.  **Identify Shortcode:** Check for shortcodes that load plugin scripts (e.g., `[wava_payment_form]`).\n    *   `grep -rn \"add_shortcode\" .`\n2.  **Create Page:** Use WP-CLI to create a public page with the shortcode.\n    *   `wp post create --post_type=page --post_status=publish --post_content='[SHORTCODE_NAME]'`\n3.  **Extract Nonce:**\n    *   Navigate to the newly created page using `browser_navigate`.\n    *   Inspect `wp_localize_script` output. Look for keys like `wava_vars`, `wava_payment_params`, or `wava_ajax_obj`.\n    *   Execution agent command: `browser_eval(\"window.wava_vars?.nonce\")` (Replace `wava_vars` with the actual JS object name found in the source).\n\n*Note: If the function is hooked to `admin_init` without a nonce check, no nonce is required.*\n\n### 5. Exploitation Strategy\nThe goal is to modify the payment recipient's API keys or settings to intercept payments.\n\n1.  **Locate Target Action:** \n    *   `grep -rn \"update_option\" .` inside the plugin directory.\n    *   Look for associated function names and trace back to an `add_action` call.\n2.  **Construct Payload:**\n    *   Identify the parameter names (e.g., `wava_public_key`, `wava_secret_key`, or an array `wava_settings[...]`).\n3.  **Send Request:**\n    Using the `http_request` tool:\n    *   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n    *   **Method:** `POST`\n    *   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n    *   **Body:** `action=TARGET_ACTION&nonce=NONCE_VALUE&setting_key=malicious_value&save_changes=1`\n\n### 6. Test Data Setup\n1.  Install Wava Payment \u003C= 0.3.7.\n2.  Configure the plugin with dummy API keys via the WordPress admin dashboard.\n3.  Identify the option name used by the plugin:\n    *   `wp option list | grep wava`\n4.  (Optional) Create a page with the plugin's shortcode to facilitate nonce extraction if needed.\n\n### 7. Expected Results\n*   The server should return a success response (e.g., `200 OK` or `{\"success\":true}`).\n*   The targeted WordPress option (e.g., `wava_payment_settings`) should be updated with the attacker's value.\n*   Subsequent checkouts on the site will use the attacker-controlled configuration.\n\n### 8. Verification Steps\nAfter sending the exploit request, verify the change using WP-CLI:\n1.  Check the relevant option:\n    *   `wp option get wava_payment_settings` (or the identified option name).\n2.  Verify that the values match the payload sent in the `http_request`.\n3.  Example: `wp option get wava_payment_settings --field=public_key` should return `malicious_value`.\n\n### 9. Alternative Approaches\n*   **Admin-Init Trigger:** If no AJAX action is found, try sending a POST request to `\u002Fwp-admin\u002Findex.php` or `\u002Fwp-admin\u002Fadmin-ajax.php` with the parameters used in the plugin's settings form. The `admin_init` hook fires on all admin-area requests, including those made by unauthenticated users to `admin-ajax.php`.\n*   **Direct Option Overwrite:** If the plugin uses a generic update function, check if it allows updating arbitrary options (e.g., `wp_ajax_nopriv_wava_save` with a `name` and `value` parameter). This could lead to a site takeover if `users_can_register` or `default_role` can be modified.","The Wava Payment plugin for WordPress is vulnerable to unauthorized access because it fails to perform capability checks on administrative functions, particularly those handling settings updates. Unauthenticated attackers can exploit this by sending POST requests to AJAX or admin initialization hooks to modify sensitive plugin configurations like payment API keys.","1. Identify the administrative action responsible for saving settings, typically registered via 'admin_init' or 'wp_ajax_' hooks.\n2. If a nonce is required for validation, locate a public page utilizing a plugin shortcode (e.g., '[wava_payment_form]') and extract the nonce from the localized JavaScript objects (e.g., 'window.wava_vars.nonce').\n3. Construct a POST request to '\u002Fwp-admin\u002Fadmin-ajax.php' containing the vulnerable 'action' parameter and the desired configuration values, such as 'wava_public_key' or 'wava_secret_key'.\n4. Submit the request unauthenticated to overwrite the plugin's settings in the WordPress options table, allowing the attacker to redirect payment flows or intercept transaction data.","gemini-3-flash-preview","2026-04-21 03:18:25","2026-04-21 03:18:52",{"type":30,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":31},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwava-payment\u002Ftags"]