Atomic Edge analysis of CVE-2026-0684:
This vulnerability is an authorization bypass in the CP Image Store with Slideshow WordPress plugin. The flaw allows authenticated users with Contributor-level permissions or higher to import arbitrary products via XML. The vulnerability affects all plugin versions up to and including 1.1.9, with a CVSS score of 4.3.
The root cause is a flawed logic condition within the `cpis_admin_init` function. The vulnerable code is located in the main plugin file, `cp-image-store/cp-image-store.php`, around line 826. The original condition `if ( empty( $_POST[‘cpis_import’] ) || ! ( wp_verify_nonce( … ) || ! current_user_can( ‘manage_options’ ) ) )` contains a critical error in its grouping of boolean operators. The logic incorrectly allows the import to proceed if the user does NOT have the `manage_options` capability, effectively inverting the intended permission check.
Exploitation requires an attacker to have a valid Contributor-level WordPress account. The attacker must first upload a malicious XML product file to the server via legitimate means. They then trigger the import functionality by sending a POST request to the WordPress admin area, likely via `admin-ajax.php` or `admin-post.php`, with the `cpis_import` parameter containing a valid nonce. The nonce verification passes, but the flawed logic bypasses the `current_user_can(‘manage_options’)` check, granting unauthorized import access.
The patch in version 1.2.0 refactors the flawed conditional statement. The corrected code on lines 826-831 separates the three checks with explicit logical AND (`&&`) relationships. The new condition requires all three to be true: the `cpis_import` POST parameter must not be empty, the nonce must verify successfully, AND the user must have the `manage_options` capability. This enforces the intended authorization requirement that only administrators can perform imports.
Successful exploitation allows an attacker with low-level privileges to import arbitrary product data. This could lead to unauthorized modification of the store’s catalog, injection of malicious links or content, or disruption of normal store operations. While the attack requires a pre-uploaded XML file and Contributor access, it represents a clear privilege escalation within the plugin’s administrative functions.
--- a/cp-image-store/cp-image-store.php
+++ b/cp-image-store/cp-image-store.php
@@ -3,7 +3,7 @@
Plugin Name: CP Image Store with Slideshow
Plugin URI: http://wordpress.dwbooster.com/content-tools/image-store#download
Description: Image Store is an online store for the sale of image files: images, predefined pictures, clipart, drawings, vector images. For payment processing, Image Store uses PayPal, which is the most widely used payment gateway, safe and easy to use.
-Version: 1.1.9
+Version: 1.2.0
Author: CodePeople
Author URI: http://wordpress.dwbooster.com/content-tools/image-store
Text Domain: cp-image-store
@@ -86,7 +86,7 @@
$cpis_layout = array();
// CONST
-define( 'CPIS_VERSION', '1.1.9' );
+define( 'CPIS_VERSION', '1.2.0' );
define( 'CPIS_PLUGIN_DIR', dirname( __FILE__ ) );
define( 'CPIS_PLUGIN_URL', plugins_url( '', __FILE__ ) );
define( 'CPIS_ADMIN_URL', rtrim( admin_url( get_current_blog_id() ), '/' ) . '/' );
@@ -823,7 +823,11 @@
add_filter( 'upload_dir', 'cpis_upload_dir' );
try {
- if ( empty( $_POST['cpis_import'] ) || ! ( wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['cpis_import'] ) ), 'session_id_' . session_id() ) || ! current_user_can( 'manage_options' ) ) ) {
+ if (
+ empty( $_POST['cpis_import'] ) ||
+ ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['cpis_import'] ) ), 'session_id_' . session_id() ) ||
+ ! current_user_can( 'manage_options' )
+ ) {
throw new Exception( __( 'You have not sufficient privileges to import images', 'cp-image-store' ) );
}
require_once __DIR__ . '/includes/import.php';
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-0684 - CP Image Store with Slideshow <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import
<?php
$target_url = 'https://vulnerable-site.com/wp-admin/admin-ajax.php';
$username = 'contributor_user';
$password = 'contributor_pass';
// Step 1: Authenticate and obtain cookies and nonce.
// The specific AJAX action for the import and the nonce generation endpoint
// must be identified via plugin code review. This PoC outlines the required structure.
// $ch = curl_init();
// curl_setopt_array($ch, [
// CURLOPT_URL => $target_url,
// CURLOPT_POST => true,
// CURLOPT_POSTFIELDS => [
// 'action' => 'cpis_import_action', // The actual AJAX hook name from the plugin
// 'cpis_import' => 'VALID_NONCE_HERE', // Requires a valid nonce from a page load
// // Other required parameters for the import, likely referencing an uploaded XML file
// ],
// CURLOPT_COOKIEJAR => 'cookies.txt',
// CURLOPT_RETURNTRANSFER => true,
// ]);
// $response = curl_exec($ch);
// curl_close($ch);
// echo $response;
// Due to the prerequisite of a pre-uploaded XML file and the need to harvest
// a valid nonce from an authenticated session, a fully automated PoC is complex.
// The exploit chain involves:
// 1. Authenticating as a Contributor.
// 2. Loading an admin page to obtain a fresh nonce for the 'cpis_import' action.
// 3. Possibly uploading an XML file via another allowed function.
// 4. Sending the final POST request with the nonce to trigger the import.
// The core vulnerability is the bypass of the current_user_can('manage_options') check.
?>
