ANALYSIS · 107e7c9e · PATCHDIFF

Folder Analysisthirstyaffiliates_3.11.9 → thirstyaffiliates_3.11.10✓ COMPLETED

Started2026-08-30 00:24:14Z Finished2026-08-30 00:24:30Z Elapsed15s

Vulnerabilities 2

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2026-25024

FILTERS 0

STATUS

JUDGE

CVE MATCH

EXTENSION · 1

CWE · 0

OPTIONS

Hide “No vulnerability” Hide unjudged

1/6

All 6 CVE 1 Vuln files 2

SORT

Models/Authenticator.php

AI: 1 vulnerabilities

FUNCTIONS · SOURCE GONE CVE-2026-25024 1 TP

#003

1–1 of 1

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2026-25024

Security writeup for CVE-2026-25024

✓ 1 FILE

## The Exploit

An unauthenticated attacker can trick a site administrator into clicking a malicious link that clears all ThirstyAffiliates connection data (site UUID, account email, secret token) without the administrator's knowledge or consent.

```http
GET /?ta-clear-connection-data=1 HTTP/1.1
Host: vulnerable-wordpress-site.local
User-Agent: Mozilla/5.0
Cookie: wordpress_logged_in_xxxxx=admin_session_token_here
```

When an admin follows this URL (embedded in a phishing email, forum post, or malicious ad), the request executes immediately. The attacker observes no visible confirmation prompt — the action succeeds silently if the admin is logged in. The site's connection to ThirstyAffiliates' remote service is severed, disrupting affiliate tracking and link management until the admin re-authenticates.

**Why this still matters at admin:** This is a post-authentication CSRF, not a pre-auth vulnerability. However, the realistic threat model is compelling: a compromised admin session (stolen cookie, session fixation, malicious plugin), a multi-tenant WordPress SaaS with delegated admin roles (shop manager, editor with elevated capability), or social engineering where an admin clicks a link from a trusted-looking email. In each scenario, the attacker does not need the admin's credentials — only the ability to cause an authenticated request on their behalf.

---

## What the Patch Did

**Before:**
```php
public static function delete_connection_data() {
  if ( isset( $_GET['ta-clear-connection-data'] ) ) {
    // Admins only
    if ( current_user_can( 'manage_options' ) ) {
      self::clear_connection_data();
    }
  }
}
```

**After:**
```php
public static function delete_connection_data() {
  if ( ! isset( $_GET['ta-clear-connection-data'] ) ) {
    return;
  }

// Admins only
  if ( ! current_user_can( 'manage_options' ) ) {
    return;
  }

// If nonce is present and valid, perform the action.
  if ( isset( $_GET['_wpnonce'] ) && wp_verify_nonce( $_GET['_wpnonce'], 'ta-clear-connection-data' ) ) {
    self::clear_connection_data();
    wp_safe_redirect( admin_url() );
    exit;
  }

// Show confirmation page.
  $nonce_url = wp_nonce_url( admin_url( '?ta-clear-connection-data=1' ), 'ta-clear-connection-data' );
  wp_die(
    '<h1>' . esc_html__( 'Clear Connection Data', 'thirstyaffiliates' ) . '</h1>' .
    '<p>' . esc_html__( 'Are you sure you want to clear your ThirstyAffiliates connection data? This will remove your site UUID, account email, and secret token.', 'thirstyaffiliates' ) . '</p>' .
    '<p><a class="button button-primary" href="' . esc_url( $nonce_url ) . '">' . esc_html__( 'Yes, Clear Connection Data', 'thirstyaffiliates' ) . '</a> ' .
    '<a class="button" href="' . esc_url( admin_url() ) . '">' . esc_html__( 'Cancel', 'thirstyaffiliates' ) . '</a></p>',
    esc_html__( 'Confirm Action', 'thirstyaffiliates' ),
    array( 'back_link' => false )
  );
}
```

The patch introduced three security controls: (1) `wp_verify_nonce( $_GET['_wpnonce'], 'ta-clear-connection-data' )` to validate a cryptographic CSRF token tied to the action, (2) a confirmation dialogue (`wp_die()`) that forces the user to consciously re-affirm the destructive action, and (3) output escaping (`esc_html__()`, `esc_url()`) to prevent the confirmation page itself from becoming an XSS vector. The nonce is single-use and tied to the logged-in user's session; an attacker without access to the current admin's session cookie cannot forge a valid nonce value.

---

## Root Cause

**CWE-352: Cross-Site Request Forgery (CSRF).** The vulnerable code reads the `ta-clear-connection-data` query parameter directly from `$_GET` without verifying a CSRF token (nonce). An attacker can craft a URL containing `?ta-clear-connection-data=1` and cause an admin to follow it via email, advertisement, or embedded iframe. Because the admin's browser automatically attaches the `wordpress_logged_in_*` session cookie to all requests to the vulnerable site, the request succeeds in the context of the authenticated admin — bypassing the `current_user_can( 'manage_options' )` capability check, which only confirms *who* the user is, not *who asked* for the action. The trust boundary lies between the attacker's domain and the vulnerable site's domain: the browser enforces same-origin policy for reading responses, but not for *issuing* requests — allowing the attack to land silently.

---

## Why It Works

The load-bearing line is `wp_verify_nonce( $_GET['_wpnonce'], 'ta-clear-connection-data' )`. If you remove this single call, the vulnerability returns: an attacker can again craft a URL that clears connection data without a valid nonce. The confirmation page (`wp_die()`) is a secondary defense — it stops an attacker from automating the attack via a silent redirect or `<img>` tag, forcing the user to consciously click "Yes, Clear Connection Data" on a page they must *read* and originate from the same origin. The output-escaping functions (`esc_html__()`, `esc_url()`) protect against an attacker who controls the *content* of that confirmation page (e.g., via a reflected XSS in another parameter), ensuring that even if they inject JavaScript into the admin dashboard, it cannot execute within the nonce-protected form. The `wp_safe_redirect()` after clearing data prevents an attacker from chaining this CSRF into an open redirect. Together, these layers embody WordPress's principle of defence in depth for admin actions.

---

## Hardening Checklist

- **Use `wp_verify_nonce()` on all state-changing GET or POST requests.** Call the function immediately after checking `isset()` on the parameter and before executing the action. Tie the nonce to a specific action via the second argument (e.g., `'ta-clear-connection-data'`) and a user context via the third argument if needed.
- **Require confirmation via `wp_die()` for destructive actions.** Generate the confirmation URL using `wp_nonce_url()` so that only the re-affirmed request (with a fresh, valid nonce) executes the irreversible operation. Never skip this step for operations that delete, clear, or reset user data.
- **Escape all output in confirmation pages using context-specific functions.** Use `esc_html__()` for user-facing strings, `esc_url()` for URLs in `href` attributes, and `esc_attr()` for HTML attributes. This prevents stored or reflected XSS from hijacking the nonce form.
- **Use `wp_safe_redirect()` instead of `header( 'Location: ...' )` after admin actions succeed.** This prevents open redirects and ensures the post-action redirect stays within the site.
- **Audit existing admin actions for missing nonce validation.** Search your codebase for patterns like `if ( isset( $_GET[...] ) ) { ... current_user_can(...) ... }` without an intervening `wp_verify_nonce()` call. Prioritize destructive or data-modifying operations.

---

## References

- https://nvd.nist.gov/vuln/detail/CVE-2026-25024

CVE CVE-2026-25024

PRODUCT Folder Analysis

AFFECTED ≤ thirstyaffiliates_3.11.9

FIXED IN thirstyaffiliates_3.11.10

STATUS Generated

Security writeup · CVE-2026-25024

Source files · 1

Models/Authenticator.php Linked

↗ NVD