Vulnerability Research Plan: CVE-2026-32406

1. Vulnerability Summary

The WPC Product Bundles for WooCommerce plugin (up to and including version 8.4.5) contains a Missing Authorization vulnerability. Specifically, the AJAX handlers registered in includes/class-woosb.php fail to perform capability checks (e.g., current_user_can( 'manage_options' )), allowing any authenticated user with at least Contributor-level access to execute administrative actions.

Based on the CVSS score (I:L - Integrity Low), the primary exploit path involves the woosb_update_search_settings action, which allows an attacker to modify global plugin configuration settings related to the product search functionality.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: woosb_update_search_settings (as registered in includes/class-woosb.php line 52).
• Vulnerable Function: ajax_update_search_settings in WPCleverWoosb class.
• Authentication Required: Authenticated, Contributor role or higher.
• Payload Parameter: settings (likely a URL-encoded string or array of search configuration options).
• Preconditions: The plugin must be active, and a valid WordPress nonce for the action must be obtained.

3. Code Flow

1. Entry Point: The plugin registers AJAX hooks in WPCleverWoosb::__construct:

   add_action( 'wp_ajax_woosb_update_search_settings', [ $this, 'ajax_update_search_settings' ] );
   

2. Missing Check: In includes/class-woosb.php, the function ajax_update_search_settings is called. It lacks a check for current_user_can().
3. Sink: The function likely processes the $_POST['settings'] parameter and updates a WordPress option (e.g., woosb_search_settings) or user metadata using update_option() or update_user_meta().

4. Nonce Acquisition Strategy

The plugin enqueues scripts for the backend in admin_enqueue_scripts. The nonce required for AJAX requests is typically localized into a JavaScript object.

1. Identify Variable: WPClever plugins usually use the variable woosb_vars.
2. Navigation: Log in as a Contributor and navigate to any page where the plugin's admin scripts are loaded. Although Contributors have limited access, they can access the dashboard.
3. Extraction:
   • Navigate to: /wp-admin/index.php (Dashboard).
   • Use browser_eval to extract the nonce:

     window.woosb_vars?.nonce
     

   • If woosb_vars is not found on the dashboard, check /wp-admin/edit.php?post_type=product (Contributors can often view the product list even if they cannot edit).

5. Exploitation Strategy

Step 1: Data Setup

1. Create a user with the Contributor role.
2. Check the current value of the search settings via WP-CLI:

   wp option get woosb_search_settings
   

Step 2: Nonce Extraction

1. Log into the WordPress site as the Contributor via browser_navigate.
2. Execute browser_eval to retrieve woosb_vars.nonce.

Step 3: Trigger Unauthorized Setting Update

Submit an unprivileged POST request to modify the plugin's search behavior. We will attempt to change the limit or search_sku settings.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=woosb_update_search_settings&nonce=[EXTRACTED_NONCE]&settings=limit=999&search_sku=yes&search_exact=yes
  

6. Test Data Setup

• Plugin: WPC Product Bundles for WooCommerce 8.4.5.
• User: Contributor (username: attacker, password: password123).
• Configuration: No special configuration is required as the vulnerability is in the default AJAX handler.

7. Expected Results

• Response: The server should return a JSON success message (e.g., {"success":true}).
• State Change: The global option woosb_search_settings should be updated to reflect the values provided in the payload.

8. Verification Steps

1. Verify via CLI:

   wp option get woosb_search_settings
   

2. Check for Persistence: The output should show the modified limit (999) and other parameters injected during the exploit.
3. Security Check: Confirm that the user attacker (Contributor) does not have the manage_options capability, yet was able to change this setting.

9. Alternative Approaches

If woosb_update_search_settings proves to be restricted to user-meta only (unlikely based on the plugin structure), target the second AJAX action:

• Action: woosb_get_search_results
• Goal: Information Disclosure.
• Payload: action=woosb_get_search_results&nonce=[NONCE]&keyword=secret
• Success Criteria: If this action returns products that are in "Draft" or "Private" status which the Contributor should not be able to see, it confirms the Missing Authorization vulnerability for sensitive data retrieval.