Privilege Escalation in Consulting Theme for WordPress via Improper Access Control

The Consulting theme for WordPress (up to and including version 6.7.16) is susceptible to privilege escalation due to insecure implementation of AJAX endpoints and developer access login mechanisms. The vulnerability stems from two primary issues in the theme's codebase: the masterstudy_ms_stm_set_discard_transient AJAX action in admin/admin-notices/classes/STMHandler.php lacks capability checks and nonce validation, and the login logic in admin/classes/stm-theme-support.php relies on a transient value for authentication that can be bypassed if the site is in legacy string mode. An attacker with minimal subscriber-level access can set the stm_developer_access_token transient to a known value and subsequently trigger the authentication mechanism to impersonate any user, including administrators. This allows for full administrative access to the WordPress site.

Attack Chain

1. Attacker obtains a standard subscriber-level account on the target WordPress site.
2. Attacker crafts a request to the masterstudy_ms_stm_set_discard_transient AJAX endpoint.
3. Attacker injects a value for the stm_developer_access_token transient via the unprotected endpoint.
4. Attacker navigates to the endpoint handled by admin/classes/stm-theme-support.php.
5. The application validates the transient value as a sufficient condition for authentication in legacy mode.
6. Attacker is granted a session as the target user.
7. Attacker performs administrative actions, such as installing malicious plugins or modifying site configuration.

Impact

Successful exploitation grants a low-privileged attacker full administrative control over the affected WordPress environment. This impact includes the potential for arbitrary code execution, sensitive data exfiltration, and full site takeover.

Recommendation

Prioritized actions for security teams:

• Update the Consulting WordPress theme to the latest patched version immediately.
• Review WordPress access logs for anomalous requests to the admin-ajax.php endpoint containing masterstudy_ms_stm_set_discard_transient.
• Audit subscriber-level accounts for recent unauthorized activities or changes made to high-privilege user profiles.
• Monitor for requests targeting stm-theme-support.php paths within the web server logs.