Atomic Edge analysis of CVE-2026-1503 (metadata-based):
This vulnerability is a Cross-Site Request Forgery (CSRF) to Stored Cross-Site Scripting (XSS) chain in the login_register WordPress plugin versions up to 1.2.0. The vulnerability resides in the plugin’s settings page, specifically affecting the ‘login_register_login_post’ parameter. Attackers can inject malicious scripts that persist and execute when administrators view the compromised settings page.

Atomic Edge research infers the root cause from the CWE classification and vulnerability description. The plugin lacks nonce validation on its settings page, allowing forged requests to be processed. The plugin also fails to properly sanitize input and escape output for the ‘login_register_login_post’ parameter. These conclusions are inferred from the CWE 352 (CSRF) classification and the description’s mention of missing nonce validation and insufficient input sanitization/output escaping. No source code was available for confirmation.

Exploitation requires an attacker to trick an administrator into clicking a malicious link or visiting a crafted page while authenticated to the WordPress dashboard. The forged request likely targets the plugin’s settings update handler, typically an AJAX endpoint or admin-post.php action. A payload containing JavaScript would be submitted via the ‘login_register_login_post’ parameter. The injected script would then execute in the administrator’s browser when they later visit the plugin’s settings page.

Remediation requires two distinct code changes. Developers must implement nonce verification on the plugin’s settings update function to prevent CSRF. They must also apply proper input sanitization (e.g., `sanitize_text_field`) to the ‘login_register_login_post’ parameter upon receipt and apply appropriate output escaping (e.g., `esc_attr`, `esc_html`) when the parameter’s value is rendered in the browser.

Successful exploitation leads to stored XSS in the WordPress administration area. An attacker can execute arbitrary JavaScript in the context of an administrator’s session. This can result in session hijacking, creation of new administrative accounts, installation of backdoor plugins, or site defacement. The CVSS score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) indicates a network-based attack with low complexity, no required privileges, but requiring user interaction, leading to low integrity impact.