WP Blockade <= 0.9.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'shortcode' Parameter

This research plan outlines the steps required to demonstrate the arbitrary shortcode execution vulnerability in the WP Blockade plugin.

1. Vulnerability Summary

The WP Blockade plugin (up to version 0.9.14) fails to implement authorization and CSRF protection on its shortcode rendering preview functionality. The plugin registers an admin_post hook named wp-blockade-shortcode-render, which triggers the render_shortcode_preview() function. Because this function does not verify user capabilities (current_user_can()) or check for a valid security nonce, any authenticated user—including those with Subscriber-level privileges—can call this endpoint. The function directly passes user input from the shortcode GET parameter into the WordPress do_shortcode() function, leading to arbitrary shortcode execution.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-post.php
• Action Hook: wp-blockade-shortcode-render (registered via admin_post_wp-blockade-shortcode-render)
• HTTP Method: GET (as per vulnerability description)
• Vulnerable Parameter: shortcode
• Authentication: Required (Subscriber or higher)
• Permissions: None (Missing current_user_can check)
• CSRF Protection: None (Missing check_admin_referer or wp_verify_nonce check)

3. Code Flow (Inferred)

1. Entry Point: An authenticated user makes a GET request to /wp-admin/admin-post.php?action=wp-blockade-shortcode-render&shortcode=[payload].
2. Hook Execution: WordPress core (wp-admin/admin-post.php) detects the action and triggers the admin_post_wp-blockade-shortcode-render hook.
3. Handler Call: The plugin's render_shortcode_preview() function is called.
4. Processing:
   • The function retrieves $_GET['shortcode'].
   • It applies stripslashes() to the input.
   • Sink: It calls echo do_shortcode( stripslashes( $_GET['shortcode'] ) );.
5. Execution: WordPress parses and executes the provided shortcode. If the shortcode is registered by WordPress core or any installed plugin, it executes its respective callback.

4. Nonce Acquisition Strategy

According to the vulnerability description, the function completely lacks nonce verification.

• Nonce Requirement: None.
• Bypass Strategy: No bypass is necessary as no check exists. An attacker only needs a valid session cookie for a Subscriber-level user.

5. Exploitation Strategy

The goal is to prove that a Subscriber user can execute a shortcode that they would normally not be able to trigger, or one that returns sensitive data.

Step-by-Step Plan:

1. Login as Subscriber: Use the http_request tool to authenticate as a Subscriber user and capture the session cookies.
2. Identify Target Shortcode: We will use a WordPress core shortcode that generates distinct HTML to prove execution. The [caption] shortcode is ideal because it wraps content in a specific div or figure tag.
3. Construct Payload:
   • Shortcode: [caption width="1" caption="EXPLOIT_SUCCESS"]Vulnerable[/caption]
   • URL Encoded: %5Bcaption%20width%3D%221%22%20caption%3D%22EXPLOIT_SUCCESS%22%5DVulnerable%5B%2Fcaption%5D
4. Execute Request: Send an authenticated GET request to the admin-post.php endpoint.

Request Details:

• URL: http://localhost:8080/wp-admin/admin-post.php?action=wp-blockade-shortcode-render&shortcode=%5Bcaption%20width%3D%221%22%20caption%3D%22EXPLOIT_SUCCESS%22%5DVulnerable%5B%2Fcaption%5D
• Method: GET
• Headers: Must include the Cookie header obtained during login.

6. Test Data Setup

1. Plugin Installation: Ensure wp-blockade version 0.9.14 is installed and active.
2. User Creation: Create a Subscriber user:
   • Username: low_priv_user
   • Password: password123
   • Role: subscriber

   wp user create low_priv_user low_priv@example.com --role=subscriber --user_pass=password123
   

7. Expected Results

• HTTP Status: 200 OK
• Response Body: Should contain the rendered HTML for the caption shortcode, specifically looking for the string EXPLOIT_SUCCESS.
• Response Example:

  <div id="attachment_..." style="width: 11px" class="wp-caption alignnone">
      <p class="wp-caption-text">EXPLOIT_SUCCESS</p>
  </div>
  

8. Verification Steps

1. Check Response: Confirm that the response body contains EXPLOIT_SUCCESS and the wp-caption class.
2. Access Control Verification: Attempt the same request without a session cookie. It should either fail or behave differently (usually redirecting to login), confirming that while authentication is checked by WordPress core for admin_post, the plugin fails to check authorization (capabilities).
3. Role Check: Verify the low_priv_user is indeed a Subscriber:

   wp user get low_priv_user --field=roles
   

9. Alternative Approaches

If admin-post.php requires a specific referrer or behaves unexpectedly with GET, attempt the following:

• POST Request: Change the method to POST and send the parameters in the body:
  • action=wp-blockade-shortcode-render
  • shortcode=[caption ...]
• Information Disclosure PoC: If other plugins are present (e.g., WooCommerce, MemberPress), try to execute shortcodes that reveal information, such as [woocommerce_my_account] or plugin-specific "user info" shortcodes, to demonstrate high impact.
• Cross-Site Scripting (XSS): If any registered shortcode reflects attributes without proper escaping (common in older plugins), this vulnerability can be used as a vector for Reflected XSS targeting other authenticated users.