WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action

This vulnerability in the WP Directory Kit plugin (<= 1.4.9) allows unauthenticated attackers to extract sensitive user information, specifically email addresses, by abusing the wdk_public_action AJAX dispatcher to call the treefieldid method. The treefieldid function acts as a generic database query builder for autocomplete/lookup fields and lacks sufficient access control or input validation to prevent querying the users table.

1. Vulnerability Summary

• Vulnerability: Unauthenticated Sensitive Information Exposure (Email Addresses).
• Vulnerable Component: Wdk_frontendajax::treefieldid method, accessed via the wdk_public_action AJAX handler.
• Cause: The treefieldid method allows specifying a database model (table) and columns (attribute_id, attribute_value) to query. It uses user-supplied parameters to construct a SQL LIKE query without restricting which models (tables) or columns can be accessed.
• Authentication: Unauthenticated (via wp_ajax_nopriv_wdk_public_action).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wdk_public_action
• Vulnerable Method: treefieldid
• HTTP Method: POST
• Key Parameters:
  • wdk_controller: frontendajax (routes to Wdk_frontendajax class)
  • wdk_method: treefieldid
  • table: The model to query. In this plugin's architecture, user_m or agent_m are the likely targets for user data.
  • attribute_id: The column to use as the key (e.g., ID).
  • attribute_value: The column to expose (e.g., user_email).
  • search_term: The string to search for (e.g., @ to match all emails).
  • wdk_secure: A WordPress nonce for the action wdk_secure_treefieldid.

3. Code Flow

1. Entry Point: An unauthenticated request is sent to admin-ajax.php with action=wdk_public_action.
2. Dispatcher: The plugin's dispatcher (within the Winter MVC framework) receives wdk_controller=frontendajax and wdk_method=treefieldid. It instantiates Wdk_frontendajax and calls treefieldid().
3. Nonce Check: treefieldid() calls check_ajax_referer('wdk_secure_treefieldid', 'wdk_secure'). This nonce is localized on public pages where the Directory Kit search or agent functionality is active.
4. Query Construction:
   • The table parameter (e.g., user_m) is passed to $this->load->model($table).
   • $attr_val is taken from attribute_value (e.g., user_email).
   • $attr_search is taken from search_term (e.g., @).
   • A $where clause is built: ($id_part $attr_val_sql LIKE '%$attr_search%').
5. Information Leak: The model executes the query against the WordPress database, and the results (containing the email addresses) are returned as a JSON object to the attacker.

4. Nonce Acquisition Strategy

The treefieldid method requires a nonce (wdk_secure_treefieldid). This nonce is localized by the plugin for use in its frontend search/autocomplete features.

1. Identify Trigger: The nonce is typically localized when the [wdk_search] or [wdk_listings] shortcode is present on a page.
2. Create Page: Use WP-CLI to create a public page containing the shortcode:

   wp post create --post_type=page --post_title="Directory Search" --post_status=publish --post_content='[wdk_search]'
   

3. Extract Nonce:
   • Navigate to the newly created page using browser_navigate.
   • The plugin localizes its data into a global JavaScript object named wdk_frontend_obj.
   • Use browser_eval to extract the nonce:

     window.wdk_frontend_obj?.wdk_secure_treefieldid
     

5. Exploitation Strategy

Once the nonce is obtained, perform the following http_request:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=wdk_public_action&wdk_controller=frontendajax&wdk_method