Research Plan: WPSchoolPress <= 2.2.36 - Missing Authorization

1. Vulnerability Summary

The WPSchoolPress plugin for WordPress (versions up to 2.2.36) contains a Missing Authorization vulnerability. A specific AJAX function fails to perform a capability check (e.g., current_user_can()), allowing authenticated users with the Teacher role (a custom role created by the plugin) to perform actions intended for administrators. The CVSS score of 4.3 (Integrity: Low) suggests the vulnerability allows for unauthorized modification of data or settings that do not compromise the entire system but still represent a privilege escalation.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Authentication: Authenticated (Teacher level access).
• Vulnerable Action: An AJAX action registered via add_action( 'wp_ajax_...' ).
• Preconditions:
  • The WPSchoolPress plugin must be active.
  • A user with the teacher role must be created.
• Payload Parameter: Likely a POST request containing an action, a nonce, and data to be modified (e.g., id, setting_name, value).

3. Code Flow

1. The plugin registers AJAX handlers, typically in includes/wsp-ajax.php or lib/wsp-ajax.php (inferred).
2. The registration looks like: add_action( 'wp_ajax_WSP_ACTION_NAME', 'FUNCTION_NAME' );.
3. The FUNCTION_NAME is invoked when a POST request is sent to admin-ajax.php with action=WSP_ACTION_NAME.
4. Inside FUNCTION_NAME, the code checks for a nonce using check_ajax_referer or wp_verify_nonce.
5. The Flaw: The function proceeds to execute logic (like database updates or deletions) without verifying if the user has the manage_options capability or is an administrator.
6. The teacher role is allowed to access admin-ajax.php, so the request succeeds.

4. Nonce Acquisition Strategy

WPSchoolPress enqueues its nonces via wp_localize_script. To obtain a valid nonce for a teacher:

1. Identify Shortcode/Page: The teacher dashboard is usually at a specific URL or generated via shortcodes like [wsp_dashboard].
2. Create Access Page: Ensure a page exists with the relevant shortcode so scripts are loaded.

   wp post create --post_type=page --post_title="Dashboard" --post_status=publish --post_content='[wsp_dashboard]'
   

3. Navigate and Extract: Use the browser_navigate tool to log in as a teacher and visit the dashboard.
4. Execute JS: Use browser_eval to extract the nonce.
   • Variable Name: Based on WPSchoolPress source, check for wsp_ajax or wsp_vars.
   • Key: Common keys include ajax_nonce or nonce.
   • Command: browser_eval("window.wsp_vars?.nonce") or browser_eval("window.wsp_ajax?.nonce").

5. Exploitation Strategy

The goal is to perform an action a teacher should not be able to do, such as updating a system setting or deleting a student/teacher record.

Target Action (Inferred): wsp_delete_student or wsp_update_settings.

Step-by-Step Exploit:

1. Identify Action: Search the plugin for AJAX actions lacking current_user_can.

   grep -r "wp_ajax_" .
   

2. Verify Missing Auth: Check the handler function for the presence of current_user_can.
3. Craft Request:
   • URL: http://localhost:8080/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded, Cookie: [Teacher Cookies]
   • Body: action=[VULN_ACTION]&nonce=[EXTRACTED_NONCE]&[PARAM_NAME]=[VALUE]

Example Payload (Inferred - Deleting a student record):

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost:8080
Content-Type: application/x-www-form-urlencoded

action=wsp_delete_student&nonce=a1b2c3d4e5&student_id=2

6. Test Data Setup

1. Activate Plugin: wp plugin activate wpschoolpress
2. Create Student: Use the plugin UI or WP-CLI to create a student record (ID 2).
3. Create Teacher: Create a user with the teacher role.

   wp user create attacker teacher@example.com --role=teacher --user_pass=password
   

4. Create Page: Add the dashboard page as described in Section 4.

7. Expected Results

• The HTTP response should be a 200 OK (or JSON success message like {"success":true}).
• The unauthorized action (e.g., student deletion) should be reflected in the database.
• A legitimate security check would have returned a 403 Forbidden or a JSON error message.

8. Verification Steps

1. Check Database: Confirm the record was deleted or the setting was changed.

   wp db query "SELECT * FROM wp_wsp_student WHERE student_id=2"
   

2. Verify Role: Ensure the attacker user still only has the teacher role and not administrator.

9. Alternative Approaches

If the wsp_delete_student action is protected, investigate other common WPSchoolPress AJAX actions:

• wsp_update_general_settings: Modifying site-wide school settings.
• wsp_add_mark: Modifying grades without proper permissions.
• wsp_import_students: If a teacher can trigger a CSV import, they might be able to overwrite existing data.

Search specifically for functions inside lib/wsp-ajax.php that interact with the $wpdb object but don't call current_user_can().