ANALYSIS · 419844ed· FINISHED 2026-09-02 · PATCHDIFF

edwiser-bridgecache/edwiser-bridge_4.3.2 → cache/edwiser-bridge_4.3.3✓ COMPLETED

Files53

Vulnerable46

True positives35

CVE matched12

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2026-24570

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 53 CVE 12 Vuln 46

SORT

12 files · page 1/1

admin/class-eb-email-template.php

AI: 4 vulnerabilities

CVE-2026-24570 4 TP

#%!d(float64=002)

admin/setup-wizard/class-eb-setup-wizard-functions.php

AI: 3 vulnerabilities

CVE-2026-24570 2 TP 1 FP

#%!d(float64=013)

includes/api/class-eb-blocks-my-courses-api.php

AI: 2 vulnerabilities

CVE-2026-24570 1 TP 1 FP

#%!d(float64=019)

includes/class-eb-admin-notice-handler.php

AI: 8 vulnerabilities

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-862: Missing AuthorizationCWE-20: Improper Input Validation CVE-2026-24570 4 TP 4 FP

#%!d(float64=024)

includes/class-eb-blocks.php

AI: 3 vulnerabilities

CVE-2026-24570 3 TP

#%!d(float64=025)

includes/class-eb-course-manager.php

AI: 1 vulnerabilities

CVE-2026-24570 1 TP

#%!d(float64=026)

includes/class-eb-enrollment-manager.php

AI: 1 vulnerabilities

CVE-2026-24570 1 TP

#%!d(float64=029)

includes/class-eb-manage-enrollment.php

AI: 3 vulnerabilities

CVE-2026-24570 1 TP 2 FP

#%!d(float64=032)

includes/class-eb-order-manager.php

AI: 3 vulnerabilities

CVE-2026-24570 3 TP

#%!d(float64=033)

includes/class-eb-order-status.php

AI: 1 vulnerabilities

CVE-2026-24570 1 FP

#%!d(float64=035)

includes/class-eb-user-manager.php

AI: 3 vulnerabilities

CVE-2026-24570 1 TP 2 FP

#%!d(float64=037)

includes/class-eb.php

AI: 2 vulnerabilities

CVE-2026-24570 2 TP

#%!d(float64=038)

1–12 of 12

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2026-24570

Security writeup for CVE-2026-24570

✓ 12 FILES

## The Exploit

An authenticated WordPress user with subscriber-level access or higher can invoke privileged administrative functions by sending forged AJAX requests to multiple handlers in the Edwiser Bridge plugin.

```bash
curl -X POST http://target.local/wp-admin/admin-ajax.php \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Cookie: wordpress_logged_in=<subscriber-session>" \
  -d "action=wdm_eb_get_email_template&tmpl_name=welcome&admin_nonce=<valid-nonce>"
```

The attacker observes a 200 response containing serialized email template data intended for administrators only. No permission error is returned. The attacker can then chain this to modify email templates, send test emails to arbitrary addresses, or reset template content — all without holding the `manage_options` capability.

**Why this still matters at admin:** A compromised admin account (session theft, credential stuffing, supply chain compromise) or a multi-tenant WordPress installation with segregated admin roles can escalate privileges through these unguarded AJAX handlers. A shop manager role granted only `edit_posts` can invoke functions expecting `manage_options`, bypassing role-based access control.

---

## What the Patch Did

**Before:**
```php
public function get_template_data_ajax_call_back() {
    $data = array();

// Process only if nonce is verified.
    if ( isset( $_POST['tmpl_name'] ) && isset( $_POST['admin_nonce'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['admin_nonce'] ) ), 'eb_admin_nonce' ) ) {
```

**After:**
```php
public function get_template_data_ajax_call_back() {
    $data = array();

// SECURITY FIX: Check user capability before processing.
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_send_json_error( array( 'message' => esc_html__( 'You do not have permission to perform this action.', 'edwiser-bridge' ) ) );
    }

The patch added a single authorization gate using the WordPress `current_user_can( 'manage_options' )` capability check. This primitive queries the current user's assigned roles and capabilities before executing sensitive operations. If the check fails, the function terminates early and returns a JSON error response. The patch applied this pattern across four AJAX handlers: `get_template_data_ajax_call_back()`, `send_test_email()`, `reset_email_template_content()`, and `eb_enable_course_enrollment_method()`.

---

## Root Cause

**CWE-862: Missing Authorization** ([cwe.mitre.org/data/definitions/862.html](https://cwe.mitre.org/data/definitions/862.html))

The vulnerable code trusts nonce verification alone to gate access to administrative functions. In WordPress, a nonce is a CSRF token — it proves the request originated from a legitimate page within the same site, but it does *not* encode role or capability information. An authenticated subscriber receives a valid `eb_admin_nonce` on the settings page (if they visit it) and can reuse it in requests to `admin-ajax.php` without any subsequent check of their user role.

The `wp_ajax_nopriv_wdm_eb_get_email_template` and `wp_ajax_nopriv_wdm_eb_send_test_email` hooks in `includes/class-eb.php` register the same handlers for both authenticated and *unauthenticated* users. This compounds the issue: even without a valid session, an attacker can invoke these handlers if they bypass nonce validation (or obtain a valid nonce through an open settings page endpoint). The dataflow is: `$_POST['admin_nonce']` → `wp_verify_nonce()` → handler executes. Capability check is absent.

---

## Why It Works

The single line `if ( ! current_user_can( 'manage_options' ) )` is load-bearing. Removing it restores the vulnerability. Without this check, any authenticated user whose nonce passes verification will execute the function.

The engineer correctly placed the capability check *before* the nonce verification loop. This is defense-in-depth: if the nonce check itself is bypassed or misconfigured (e.g., a typo in the action name), the capability gate still blocks execution. The order matters: capability checks are "always-on" authorization, while nonces prevent CSRF but require a valid session or prior page visit to obtain. Checking capability first is faster and prevents redundant downstream logic from running in the unauthenticated case.

The companion fix in `includes/class-eb.php` removes the `wp_ajax_nopriv_*` hook registrations for these handlers entirely. This prevents unauthenticated users from reaching the handler at all, stopping the attack at the routing layer. WordPress will not dispatch the AJAX request to an unauthenticated user if no `wp_ajax_nopriv_` hook is registered. Together, these two changes create a two-layer gate: dispatcher-level (hook registration) and function-level (capability check).

---

## Hardening Checklist

- **Audit all AJAX handlers registered with `wp_ajax_nopriv_*` hooks.** These are intentionally public; verify that each one's corresponding function contains an early `current_user_can()` check with the narrowest required capability, and document why unauthenticated access is necessary. Remove the `wp_ajax_nopriv_` hook if authenticated access is sufficient.

- **Wrap every AJAX function with a capability gate before nonce verification.** Use `if ( ! current_user_can( 'manage_options' ) ) { wp_send_json_error( ... ); }` as a template. Place this check on the first line of the handler, not inside conditional branches that parse user input.

- **Use `check_ajax_referer()` instead of manual `wp_verify_nonce()` calls.** This function halts execution immediately on failure, preventing partial state changes. For example: `check_ajax_referer( 'eb_admin_nonce', 'admin_nonce' );` instead of `if ( wp_verify_nonce( ... ) ) { ... }`.

- **Grep the codebase for `wp_ajax_nopriv_` hooks and verify each against a hardening matrix.** Columns: hook name, handler function, required capability, business justification. Any public AJAX endpoint should be filed as a ticket for review.

- **Test role downgrade scenarios in integration tests.** Create a subscriber user, obtain a nonce from a public page (or inject it via a fixture), then invoke sensitive AJAX handlers. Assert that `wp_send_json_error()` is returned, not the sensitive data.

---

## References

- [CVE-2026-24570 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-24570)
- [Edwiser Bridge Changelog](https://edwiser.org/bridge/)
- [WordPress Plugin Security: Missing Authorization (CWE-862)](https://developer.wordpress.org/plugins/security/authorization/)

CVE CVE-2026-24570

PRODUCT edwiser-bridge

AFFECTED ≤ cache/edwiser-bridge_4.3.2

FIXED IN cache/edwiser-bridge_4.3.3

STATUS Generated

Security writeup · CVE-2026-24570

Source files · 12

admin/class-eb-email-template.php Linked

admin/setup-wizard/class-eb-setup-wizard-functions.php Linked

includes/api/class-eb-blocks-my-courses-api.php Linked

includes/class-eb-admin-notice-handler.php Linked

includes/class-eb-blocks.php Linked

includes/class-eb-course-manager.php Linked

includes/class-eb-enrollment-manager.php Linked

includes/class-eb-manage-enrollment.php Linked

includes/class-eb-order-manager.php Linked

includes/class-eb-order-status.php Linked

includes/class-eb-user-manager.php Linked

includes/class-eb.php Linked

↗ NVD