Exploitation Research Plan - CVE-2026-9014 (WP Promoter)

1. Vulnerability Summary

The WP Promoter plugin (<= 1.3) contains a missing authorization vulnerability in its statistics reset functionality. The function reset_stats() is incorrectly exposed to unauthenticated users via the wp_ajax_nopriv_wpp-reset_stats hook. Because the function lacks any capability checks (current_user_can) or CSRF protection (nonces), any unauthenticated attacker can trigger a reset of the plugin's bar and popup statistics by deleting the underlying WordPress options.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: wpp-reset_stats
• HTTP Method: POST (standard for AJAX, though GET might also work depending on implementation)
• Parameters: action=wpp-reset_stats
• Authentication: None required (vulnerable via nopriv hook)
• Preconditions: The plugin must be active.

3. Code Flow

Based on the vulnerability description, the execution flow is as follows:

1. Entry Point: An HTTP request hits admin-ajax.php with the parameter action=wpp-reset_stats.
2. Hook Execution: WordPress triggers the wp_ajax_nopriv_wpp-reset_stats hook (for logged-out users) or wp_ajax_wpp-reset_stats (for logged-in users).
3. Target Function: The plugin's reset_stats() function (inferred) is called.
4. Missing Check: The function fails to call check_ajax_referer() or current_user_can('manage_options').
5. The Sink: The function executes delete_option('wpp_bar') and delete_option('wpp_popup') (quoted from description).
6. Response: The plugin likely exits using wp_die() or wp_send_json_success().

4. Nonce Acquisition Strategy

According to the vulnerability description, the reset_stats() function contains no nonce validation.

• Action String: Not applicable.
• Bypass: No bypass is necessary as the security check is entirely absent in the vulnerable versions.

Note: If testing reveals a nonce is actually present but the description was slightly inaccurate, the agent should search for wp_localize_script in the plugin source to identify the JS variable name (likely something like wpp_vars or wpp_ajax) and use browser_eval to extract it.

5. Exploitation Strategy

The goal is to demonstrate that an unauthenticated request can successfully delete the statistics options.

Step-by-step Plan:

1. Prepare Request: Construct a POST request to the AJAX endpoint.
2. Execute Request: Use http_request to send the payload.
3. Payload Structure:
   • URL: {{base_url}}/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body: action=wpp-reset_stats

6. Test Data Setup

To verify the impact, we must first ensure the statistics options exist and contain data.

1. Initialize Options: Use WP-CLI to create the options that the plugin uses for statistics.

   wp option update wpp_bar '{"views": 100, "clicks": 50}' --format=json
   wp option update wpp_popup '{"views": 200, "clicks": 75}' --format=json
   

2. Confirm Setup:

   wp option get wpp_bar
   wp option get wpp_popup
   

7. Expected Results

• HTTP Response: The server should return a 200 OK status. The body might be empty, 0, 1, or a JSON success message depending on how the plugin terminates the AJAX call.
• Database State: The options wpp_bar and wpp_popup should no longer exist in the wp_options table (or should be reset to default/empty values).

8. Verification Steps

After the http_request tool completes, verify the deletion using WP-CLI:

1. Check Options:

   wp option get wpp_bar
   wp option get wpp_popup
   

2. Success Criteria: If WP-CLI returns an error like Error: Could not get 'wpp_bar' option., the exploit is successful because the unauthenticated request triggered the delete_option() call.

9. Alternative Approaches

• Method Variation: If POST fails, attempt a GET request: /wp-admin/admin-ajax.php?action=wpp-reset_stats.
• Parameter Variation: If the options are not deleted, check the source code for a specific "type" parameter (e.g., action=wpp-reset_stats&type=bar) that might be required to target a specific option, though the description implies both are deleted.
• Capability Check Verification: Attempt the request with a low-privileged user (Subscriber) to confirm that no capability checks are enforced for any level of user.