Exploitation Research Plan: CVE-2026-57766 (WPIDE CSRF)

1. Vulnerability Summary

The WPIDE – File Manager & Code Editor plugin (up to version 3.5.6) contains a Cross-Site Request Forgery (CSRF) vulnerability. This vulnerability exists because a critical state-changing function—likely related to file saving or plugin configuration—fails to implement or incorrectly validates a WordPress nonce. An attacker can exploit this by tricking an authenticated administrator into visiting a malicious webpage, which then triggers an unauthorized action (such as writing a malicious PHP file to the server) in the context of the administrator's session.

2. Attack Vector Analysis

• Vulnerable Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: wpide_save_file (inferred) or wpide_save_content (inferred)
• HTTP Method: POST
• Vulnerable Parameter: content (inferred - the code to be written) and path (inferred - the destination file path)
• Authentication Level: Requires a session of a user with the manage_options capability (typically an Administrator), but the request itself is "unauthenticated" from the attacker's perspective, relying on the victim's browser cookies.
• Preconditions: The victim must be an logged-in Administrator and must be induced to trigger a cross-site request (e.g., clicking a link or visiting an attacker-controlled site).

3. Code Flow (Inferred)

1. Hook Registration: The plugin registers an AJAX handler in its initialization logic:
   add_action('wp_ajax_wpide_save_file', array($this, 'save_file_callback')); (inferred)
2. Handler Function: The function save_file_callback() (inferred) is invoked when the AJAX action is called.
3. Vulnerability: Inside the handler, the code checks for user capabilities (e.g., current_user_can('manage_options')) but misses a nonce check like check_ajax_referer('wpide_nonce', 'nonce').
4. Sink: The function then passes user-controlled input ($_POST['path'] and $_POST['content']) directly into a file system operation (e.g., file_put_contents or a wrapper function), allowing the attacker to write arbitrary code to the filesystem.

4. Nonce Acquisition Strategy

According to the vulnerability description, nonce validation is either missing or incorrect.

• If Missing: No nonce is required. The exploit will focus on sending the POST request to admin-ajax.php with only the action, path, and content parameters.
• If Incorrect (e.g., uses action -1): If the plugin verifies a nonce but uses a generic action string like -1, the agent can acquire a valid nonce from any page where a generic nonce is leaked.
• Verification Method: To confirm no nonce is needed, the agent should first attempt the exploit via http_request using the administrator's cookies but omitting any nonce parameter. If the response indicates success, the nonce check is confirmed as missing.

5. Exploitation Strategy

The goal is to demonstrate Remote Code Execution (RCE) by creating a new PHP file in the plugin directory via the CSRF vulnerability.

Step-by-Step Plan:

1. Target Identification: Confirm the presence of WPIDE 3.5.6.
2. Endpoint Testing: Use the http_request tool (acting as the logged-in admin) to test if admin-ajax.php accepts the wpide_save_file action without a nonce.
3. Payload Construction:
   • URL: http://[target]/wp-admin/admin-ajax.php
   • Method: POST
   • Content-Type: application/x-www-form-urlencoded
   • Body: action=wpide_save_file&path=pwn.php&content=<?php phpinfo(); ?> (inferred parameters)
4. Execution:
   • The agent will use http_request with the admin's cookie jar to send the payload.
   • For a "true" CSRF simulation, the agent can use browser_navigate to a local HTML file that auto-submits a form to the target URL.

6. Test Data Setup

1. Plugin Installation: Install and activate WPIDE 3.5.6.
2. Admin User: Ensure an administrator account exists and is logged in (cookies captured).
3. Directory Permissions: Ensure the wp-content/plugins/wpide/ directory is writable by the web server.

7. Expected Results

• HTTP Response: The request should return a 200 OK status with a success message (e.g., {"success":true} or 1).
• File Creation: A file named pwn.php should be created in the WPIDE plugin directory or the root WordPress directory.
• Execution: Navigating to http://[target]/wp-content/plugins/wpide/pwn.php should display the PHP info page.

8. Verification Steps (Post-Exploit)

Use wp_cli to verify the state of the filesystem:

1. Check file existence:
   wp eval "echo file_exists(WP_PLUGIN_DIR . '/wpide/pwn.php') ? 'Created' : 'Failed';"
2. Check file content:
   wp eval "echo file_get_contents(WP_PLUGIN_DIR . '/wpide/pwn.php');"
3. Verify RCE: Use http_request to GET the newly created file and check for the "PHP Version" string.

9. Alternative Approaches

• Settings Overwrite: If wpide_save_file is not the vulnerable action, search for wpide_save_settings or wpide_update_options (inferred names). CSRF here could be used to change the "Allowed File Extensions" to include .php if it was previously restricted.
• Path Traversal: Attempt to use path=../../wp-config.php to overwrite critical system files if the plugin does not sanitize the file path, potentially leading to immediate site takeover.