Anti-Malware Security and Brute-Force Firewall <= 4.23.89 - Unauthenticated Stored Cross-Site Scripting

This exploitation research plan targets CVE-2026-57691, an unauthenticated stored cross-site scripting (XSS) vulnerability in the Anti-Malware Security and Brute-Force Firewall plugin for WordPress.

---

1. Vulnerability Summary

• Vulnerability: Unauthenticated Stored XSS
• Location: The vulnerability resides in the logging mechanism of the plugin's Firewall and Scan engine, specifically within the functions responsible for displaying "Threats" or "Firewall Blocks" in the admin dashboard (likely within images/index.php or the main settings rendering logic).
• Cause: The plugin captures request metadata (such as the User-Agent or REQUEST_URI) when a firewall event is triggered or a "Potential Threat" is identified. This data is stored in the WordPress options table (using GOTMLS_update_option) and later rendered in the admin settings page (GOTMLS-settings) without sufficient output escaping (e.g., missing esc_html).

2. Attack Vector Analysis

• Endpoint: Any public-facing WordPress page (to trigger the firewall) or wp-comments-post.php (to trigger the database scanner).
• Vulnerable Parameter: HTTP_USER_AGENT header or the content of a public-facing database entry (like a comment).
• Authentication: None (Unauthenticated).
• Preconditions: The Firewall must be active, or a scan must be initiated by the administrator to view the "threats."

3. Code Flow

1. Entry (Unauthenticated): An attacker sends a crafted HTTP request that contains a known "threat" pattern (e.g., the string eval( or preg_replace(.../e)) to trigger the plugin's detection logic defined in $GLOBALS["GOTMLS"]["tmp"]["definitions_array"].
2. Detection: The plugin's Firewall/Scanner (logic in images/index.php) identifies the "threat."
3. Storage: The plugin logs the event. It captures the User-Agent of the malicious request and stores it using GOTMLS_update_option('scan_log', ...).
4. Admin View: An administrator navigates to the "Anti-Malware" settings page (/wp-admin/admin.php?page=GOTMLS-settings).
5. Sink: The function GOTMLS_load_scanlog (or similar logic) retrieves the log data. The stored User-Agent is echoed directly into the HTML table of scan results without being passed through esc_html() or esc_attr().

4. Nonce Acquisition Strategy

This vulnerability is exploited by injecting data that an administrator will later view. The injection phase is unauthenticated and does not require a nonce.

However, if the automated agent needs to verify the injection by simulating an admin view:

1. Identify Variable: The plugin localizes its settings. Look for a variable like GOTMLS_objects or gotmls_admin_data.
2. Shortcode: The plugin primarily operates in the admin backend, but scripts are enqueued via admin_enqueue_scripts.
3. Extraction:
   • Navigate to: /wp-admin/admin.php?page=GOTMLS-settings (as Admin).
   • browser_eval("window.GOTMLS_objects?.nonce") (inferred).
   • The GOTMLS_set_nonce function in index.php suggests a custom nonce system: $head_nonce = GOTMLS_set_nonce(__FUNCTION__."100");.

5. Exploitation Strategy

Step 1: Trigger Firewall via User-Agent Injection

We send a request that triggers the firewall's "Potential Threat" detection by including a signature (like eval() in the query string while placing the payload in the User-Agent.

• Tool: http_request
• URL: http://localhost:8080/?s=eval(base64_decode('...'))
• Method: GET
• Headers:
  • User-Agent: <img src=x onerror="alert('CVE-2026-57691_XSS')">
• Expected Response: The plugin may block the request or simply log the "Potential Threat."

Step 2: Trigger Scanner via "Tagged Code" (Alternative)

The plugin specifically looks for #TAG# ... #/TAG# patterns.

• Tool: http_request
• URL: http://localhost:8080/wp-comments-post.php
• Method: POST
• Body (URL-encoded):
  comment=#GOTMLS# <script>alert(document.domain)</script> #/GOTMLS#&author=Attacker&email=attacker@example.com&comment_post_ID=1

6. Test Data Setup

1. Ensure the Anti-Malware Security and Brute-Force Firewall plugin is active.
2. (Optional) Enable "Brute-Force Protection" or "Firewall" options if not active by default.
3. Create a standard post (ID: 1) to allow comment submission.

7. Expected Results

• The malicious User-Agent or the content within the #GOTMLS# tags will be saved in the GOTMLS_scan_log_blob or GOTMLS_settings_array option in the database.
• When the administrator visits the "Scan Settings" page, the JavaScript alert() will execute in their browser context.

8. Verification Steps

1. WP-CLI Check: Verify the payload is stored in the options.

   wp option get GOTMLS_scan_log_blob | grep "CVE-2026-57691_XSS"
   

2. Browser Verification:
   • Navigate to /wp-admin/admin.php?page=GOTMLS-settings.
   • Check for the alert box or inspect the DOM for the injected <img> tag.

9. Alternative Approaches

• Request URI Vector: If the User-Agent is sanitized, the plugin also defines GOTMLS_script_URI using $_SERVER["REQUEST_URI"]. Attempt to inject into a URI fragment that bypasses the htmlspecialchars used in images/index.php.
• Referer Vector: Many security plugins log the Referer header. Send the payload in the Referer header while triggering a firewall block.