Description

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the 'iepa_builder' meta key.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-19T08:16:53.467Z",
  "pubdate": "2026-09-19T08:16:53.467Z",
  "executiveSummary": "The Ibtana – Ecommerce Product Addons plugin for WordPress is affected by an authorization bypass vulnerability stemming from a missing capability check on the 'iepa_use_gt_editor' AJAX action.\nThis security flaw allows authenticated attackers, including those with minimal privileges such as Subscriber-level accounts, to perform unauthorized modifications or deletions of arbitrary post meta data associated with the 'iepa_builder' meta key.\nThe vulnerability type is categorized as an insecure direct object reference or unauthorized meta manipulation due to insufficient access control validation.\nThe impact of this vulnerability is significant, as it enables low-privileged users to alter product-related data or internal configuration meta, potentially leading to unauthorized data manipulation or further exploitation.\nExploitation requires the attacker to be authenticated on the WordPress instance. Given that Subscriber is the default role for many registered users, the attack surface includes any system allowing user registration.\nNo specific preconditions beyond basic authentication are required, making this a critical concern for site integrity and data consistency.",
  "technicalDetails": "The vulnerability resides within the AJAX handler associated with the 'iepa_use_gt_editor' action in the Ibtana – Ecommerce Product Addons plugin. In the affected versions, up to and including 0.4.7.7, the plugin fails to implement a proper 'current_user_can()' check within the handler function to verify if the requester possesses the necessary administrative or editor capabilities before processing the request.\nThe root cause of this vulnerability is the improper implementation of WordPress AJAX hooks, where the security nonces or user capability checks are absent or incorrectly applied. Consequently, any user with a valid session—including those with the lowest privileges—can invoke the handler to interact with the 'update_post_meta' or 'delete_post_meta' functions.\nThe attack flow proceeds as follows: First, an attacker identifies the 'iepa_use_gt_editor' AJAX endpoint. Second, the attacker crafts a malicious request targeting this endpoint, typically including a payload containing a target 'post_id' and the desired value for the 'iepa_builder' meta key. Third, because the plugin lacks the required authorization logic, the backend blindly accepts the request from the authenticated session.\nWhen processed, the vulnerable function uses the user-supplied data to update or remove records in the 'wp_postmeta' table. Since the 'iepa_builder' meta key is often used to store configuration or layout data for the plugin's features, an attacker can overwrite this content to alter the display, functionality, or behavior of products managed by the plugin.\nThis level of unauthorized access facilitates a wide range of post-exploitation activities, including potential defacement of product pages or the injection of malicious serialized data if the plugin unserializes this meta input upon rendering. Because the vulnerability allows for the deletion of existing meta entries, attackers may also disrupt core plugin operations, leading to a denial-of-service condition regarding the plugin's functionality. The lack of validation on the input allows for arbitrary manipulation of the meta key, provided the user knows the target post identifier, which is generally public information in a WordPress environment.\nThe issue is consistent across all versions through 0.4.7.7, affecting all installations where the plugin is active and registration is enabled."
}