ANALYSIS · 38b02e24 · PATCHDIFF

Folder Analysiscomputer-repair-shop_4.1132 → computer-repair-shop_4.1133✓ COMPLETED

Started2026-08-06 00:17:27Z Finished2026-08-06 00:18:23Z Elapsed55s

Vulnerabilities 35

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2026-39584

FILTERS 0

STATUS

JUDGE

CVE MATCH

EXTENSION · 1

CWE · 0

OPTIONS

Hide “No vulnerability” Hide unjudged

2/18

All 18 CVE 2 Vuln files 14

SORT

lib/includes/main_page.php

AI: 2 vulnerabilities

FUNCTIONS · SOURCE GONE CVE-2026-39584 2 TP

#009

lib/includes/theme_functions.php

AI: 3 vulnerabilities

FUNCTIONS · SOURCE GONE CVE-2026-39584 3 TP

#012

1–2 of 2

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2026-39584

Security writeup for CVE-2026-39584

✓ 2 FILES

## The Exploit

An authenticated subscriber-level user can POST to an AJAX endpoint to modify shop settings without administrative approval, because the plugin validates CSRF tokens but skips capability checks.

```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.local
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_logged_in=subscriber_session_token

action=wcrb_main_setting_form_submit&wcrb_main_setting_nonce_field=valid_nonce_here&wcrb_shop_name=Pwned%20Shop&wcrb_shop_email=attacker@evil.com&wcrb_shop_phone=1234567890&wcrb_shop_address=attacker_address
```

The attacker is a subscriber (role ID 4, minimum permission level on the install). The server responds with HTTP 200 and updates `wp_options` table rows for `wcrb_shop_name`, `wcrb_shop_email`, and `wcrb_shop_phone` to attacker-supplied values. A shop manager opening the settings page now sees the shop branded with attacker contact details, and any outbound customer emails carry the attacker's email as a reply-to field.

## What the Patch Did

**Before**
```php
if ( ! isset( $_POST['wcrb_main_setting_nonce_field'] ) || ! wp_verify_nonce( $_POST['wcrb_main_setting_nonce_field'], 'wcrb_main_setting_nonce' ) ) {
    $message = esc_html__("Something is wrong with your submission!", "computer-repair-shop");
} else {
    // Process setting updates directly
```

**After**
```php
if ( ! current_user_can( 'manage_options' ) ) {
    wp_send_json_error( array( 'message' => 'Unauthorized' ) );
    wp_die();
}

if ( ! isset( $_POST['wcrb_main_setting_nonce_field'] ) || ! wp_verify_nonce( $_POST['wcrb_main_setting_nonce_field'], 'wcrb_main_setting_nonce' ) ) {
    $message = esc_html__("Something is wrong with your submission!", "computer-repair-shop");
} else {
    // Process setting updates
```

The patch added a `current_user_can( 'manage_options' )` capability check before nonce validation. In WordPress, the `manage_options` capability belongs exclusively to administrators on single-site installs; on multisite, it can be delegated to super-admins. The check gates entry to the entire settings handler, and if the user lacks the capability, execution terminates with `wp_die()` rather than proceeding to the vulnerable update logic.

## Root Cause

**CWE-862: Missing Authorization** — The handler `wcrb_main_setting_form_submit()` in `lib/includes/main_page.php` (line 1086) receives attacker-controlled POST parameters `wcrb_main_setting_nonce_field`, `wcrb_shop_name`, `wcrb_shop_email`, etc. The nonce is verified to prevent CSRF, but WordPress capability checks (`current_user_can()`) are never consulted before the parameters reach the database update sink at lines 1095+. The trust boundary between subscriber and administrator roles is crossed without enforcement. An identical issue exists in `wcrb_currency_setting_form_submit()` at line 998, and a third in the AJAX handler `wcrb_reload_customer_data()` in `theme_functions.php` line 5435, which lacks both nonce and role verification.

## Why It Works

The single load-bearing line is `if ( ! current_user_can( 'manage_options' ) ) wp_die();` — without it, subscribers proceed directly to the nonce check and option update. The engineer added the secondary lines (`wp_send_json_error()` and explicit `wp_die()`) for user-facing clarity and graceful error handling: they ensure that rejected requests return a JSON response explaining the denial rather than a silent 200 OK. However, the capability check itself is the gatekeeper. Nonce validation alone does not restrict *who* can POST; it restricts *which* requests are legitimate from *any* authenticated user. A nonce is valid whether you are a subscriber or an admin, because it is keyed only to the session and action name. The patch correctly places the role check *before* nonce verification: nonces are expensive to compute (they read the database), so rejecting unauthorized users first saves cycles.

## Hardening Checklist

- **Audit every AJAX handler** registered via `add_action( 'wp_ajax_...', callback )` or `add_action( 'wp_ajax_nopriv_...', callback )` and prepend a `current_user_can( 'required_capability' )` check; use `wp_ajax_nopriv` only for public-facing actions (e.g., cart add).
- **Validate nonces after capability checks**, not before. Structure as: capability check → nonce check → input validation → database operation. This mirrors WordPress core patterns in `wp-admin/options.php`.
- **Use `wp_verify_nonce()` on every state-altering POST**, even if capability-gated. Nonce + capability is defense in depth; either alone is insufficient.
- **Prohibit direct `$_POST` or `$_GET` access in handlers** intended for admin use; wrap parameters in sanitization routines such as `sanitize_text_field()` and escaped output functions like `esc_attr()` to prevent secondary injection.
- **Document required roles in callback comments**, e.g., `// Requires: manage_options (admin only)`, so future maintainers understand the threat model.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2026-39584

CVE CVE-2026-39584

PRODUCT Folder Analysis

AFFECTED ≤ computer-repair-shop_4.1132

FIXED IN computer-repair-shop_4.1133

STATUS Generated

Security writeup · CVE-2026-39584

Source files · 2

lib/includes/main_page.php Linked

lib/includes/theme_functions.php Linked

↗ NVD