Research Plan: CVE-2025-13753 - Unauthorized Table Creation in WP Table Builder

Vulnerability Summary

The WP Table Builder plugin (versions <= 2.0.19) contains an incorrect authorization vulnerability in its save_table() AJAX handler. The function WP_Table_Builder\Inc\Admin\Admin_Menu::save_table() validates authorization using an "OR" logic between two conditions: one that checks for a specific capability (Settings_Manager::ALLOWED_ROLE_META_CAP) and a nonce, and another that checks only a nonce (wptb-import-security-nonce).

Because the second condition lacks a capability check (current_user_can), any authenticated user (including Subscribers) who can obtain the wptb-import-security-nonce can trigger the insert_table_to_db() function to create new wptb-tables posts.

Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php?action=save_table
• Method: POST
• Authentication: Authenticated (Subscriber level or higher)
• Vulnerable Parameter: The request body must be a JSON object containing security_code (the nonce) and content.
• Precondition: The attacker must be logged in as a Subscriber and extract the wptb-import-security-nonce.

Code Flow

1. Entry Point: The AJAX action wp_ajax_save_table is registered in Inc\Admin\Admin_Menu::__construct() and points to save_table().
2. Input Handling: save_table() reads the raw request body using file_get_contents('php://input') and decodes it via json_decode.
3. Vulnerable Authorization Check:

   $verified = current_user_can(Settings_Manager::ALLOWED_ROLE_META_CAP) && wp_verify_nonce($params->security_code, 'wptb-security-nonce');
   $import_verified = wp_verify_nonce($params->security_code, 'wptb-import-security-nonce');
   
   if (!$verified && !$import_verified) {
       wp_die(json_encode(['security_problem', '']));
   }
   

   If $import_verified is true, the check passes regardless of the user's capabilities.
4. Logic Path:
   • The code checks if $params->id exists and is a valid post.
   • If !property_exists($params, 'id'), it proceeds to $this->insert_table_to_db($params).
5. Sink: insert_table_to_db() calls wp_insert_post() with 'post_type' => 'wptb-tables', creating a new table in the database.

Nonce Acquisition Strategy

The wptb-import-security-nonce is used by the plugin's import functionality. To obtain it:

1. Identify the Script: The plugin localizes data for its admin scripts. Based on the source, Admin_Menu enqueues scripts that likely contain these nonces.
2. Access Admin: Subscribers can access the WordPress dashboard (/wp-admin/profile.php).
3. Extraction:
   • Navigate to /wp-admin/ (or any admin page available to a Subscriber).
   • The plugin likely uses wp_localize_script to export nonces. Based on the plugin structure, check for a global JavaScript object.
   • Target Variable: Look for wptb_admin_obj or wptb_vars (inferred from plugin conventions).
   • Nonce Key: The key is likely import_nonce or wptb_import_nonce.
   • Browser Execution:

     // Example extraction via browser_eval
     window.wptb_admin_obj?.import_nonce || window.wptb_vars?.import_nonce
     

Exploitation Strategy

1. Log in: Use http_request to authenticate as a Subscriber.
2. Extract Nonce:
   • Use browser_navigate to go to /wp-admin/.
   • Use browser_eval to search for the nonce. Search specifically for the string "wptb-import-security-nonce" in the page source if the variable name is unclear, or iterate through localized objects.
3. Craft Payload:
   • Prepare a JSON body.
   • security_code: The extracted nonce.
   • title: "Exploit Table".
   • content: A JSON-encoded string representing a table structure (e.g., {"cells":[]}). Note: The code calls TableRenderer::render(json_decode($params->content, true)), so content must be a double-encoded JSON string or a valid JSON string that decodes to an array.
4. Execute Attack:
   • Use http_request to send a POST to admin-ajax.php?action=save_table.
   • Headers: Content-Type: application/json.
   • Body: The prepared JSON payload.

Test Data Setup

1. User Creation: Create a user with the subscriber role.
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password
2. Plugin Activation: Ensure wp-table-builder is active.

Expected Results

• The HTTP response should be a JSON array: ["saved", <POST_ID>].
• A new post of type wptb-tables should exist in the database with the title "Exploit Table".

Verification Steps

1. Check Database via CLI:

   wp post list --post_type=wptb-tables --field=post_title
   

   Confirm "Exploit Table" appears in the list.
2. Check Post Existence:

   wp post exists <POST_ID_FROM_RESPONSE>
   

Alternative Approaches

• If Subscriber access to admin is restricted: Check if the plugin enqueues the import nonce on the frontend when certain shortcodes are present.
• Shortcode Search: grep -r "add_shortcode" . to find elements that might trigger script loading.
• Nonce Bypass via Action Mismatch: If wptb-import-security-nonce is not found, check if wp_verify_nonce($params->security_code, -1) (the default action) is ever triggered or if the nonce check is absent in other AJAX actions like wp_ajax_get_table. (However, the primary vulnerability identified is the OR logic in save_table).