# Querying private posts and changing post meta

Unauthenticated ajax.php in a WordPress theme let attackers run arbitrary WP_Query and insert numeric post meta, exposing scheduled posts and altering plugin behavior.

- Payout: hidden
- Severity: medium
- Program: SecNews
- Found by: sameoldstory
- Disclosed: 2016-08-09
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/157412
- Library page: https://bugbountylibrary.com/r/h1%3A157412
- Tags: area:web domain:web impact:data-leak impact:integrity kind:bounty platform:hackerone sev:medium tech:php tech:wordpress technique:source-review vuln:access-control vuln:info-disclosure vuln:privilege-escalation

**Target:** WordPress theme AJAX endpoint /wp-content/themes/SecNews-NewCustom/functions/ajax.php
**Root cause:** The theme's ajax.php passes user-supplied currentquery array directly into WP_Query and user-supplied meta/rating into add_post_meta() without authentication or validation.
**Steps:**
1. Send `curl https://www.secnews.gr/wp-content/themes/SecNews-NewCustom/functions/ajax.php --data 'action=sort&loop=main loop&currentquery[key1]=value1&currentquery[key2]=value2'` to run arbitrary WP_Query.
2. Use `currentquery[post_status]=future` to list scheduled, unpublished posts.
3. Send `curl ... --data 'id=100000&action=rate&meta=test&rating=42'` to insert arbitrary numeric post meta via add_post_meta().
4. Verify with `select * from wp_postmeta where meta_key = "test"` showing post_id 100000, value 42.
5. Alter plugin behavior, e.g. set `_bg_color_override` to 1 or `mashsb_shares` to -56994.
**How found:** Researcher inspected the theme's functions/ajax.php, noticed user input flowed into WP_Query and add_post_meta(), and tested both paths with curl.
**Exploitation:** Unauthenticated attacker hits ajax.php with crafted POST params: action=sort with currentquery array to query any post status (leaking future posts), or action=rate with id/meta/rating to write numeric meta keys, manipulating theme/plugin settings like background override and share counters.
**Escalation:** Arbitrary numeric meta writes can flip booleans, counters and timestamps across plugins, enabling info disclosure, defacement, or disk-filling database bloat.
**Insight:** Theme-level ajax.php files often pass $_POST arrays straight into WP_Query and add_post_meta(); grep custom themes for these sinks and test unauthenticated action handlers.