[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqWxoAVjvEcgIufj8tvb59gyhR54Mh53I5JVTFDL-kfw":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":30,"research_vulnerable_code":31,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":37},"CVE-2026-57691","anti-malware-security-and-brute-force-firewall-unauthenticated-stored-cross-site-scripting","Anti-Malware Security and Brute-Force Firewall \u003C= 4.23.89 - Unauthenticated Stored Cross-Site Scripting","The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.23.89 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","gotmls",null,"\u003C=4.23.89","4.23.90","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-09 00:00:00","2026-07-14 19:21:09",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F5e83b0ff-3628-47d7-92d0-429af92067bd?source=api-prod",6,[22,23,24,25],"images\u002Findex.php","index.php","readme.txt","safe-load\u002Ftrace.php","researched",false,3,"This exploitation research plan targets **CVE-2026-57691**, an unauthenticated stored cross-site scripting (XSS) vulnerability in the **Anti-Malware Security and Brute-Force Firewall** plugin for WordPress.\n\n---\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Unauthenticated Stored XSS\n*   **Location:** The vulnerability resides in the logging mechanism of the plugin's Firewall and Scan engine, specifically within the functions responsible for displaying \"Threats\" or \"Firewall Blocks\" in the admin dashboard (likely within `images\u002Findex.php` or the main settings rendering logic).\n*   **Cause:** The plugin captures request metadata (such as the `User-Agent` or `REQUEST_URI`) when a firewall event is triggered or a \"Potential Threat\" is identified. This data is stored in the WordPress options table (using `GOTMLS_update_option`) and later rendered in the admin settings page (`GOTMLS-settings`) without sufficient output escaping (e.g., missing `esc_html`).\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** Any public-facing WordPress page (to trigger the firewall) or `wp-comments-post.php` (to trigger the database scanner).\n*   **Vulnerable Parameter:** `HTTP_USER_AGENT` header or the content of a public-facing database entry (like a comment).\n*   **Authentication:** None (Unauthenticated).\n*   **Preconditions:** The Firewall must be active, or a scan must be initiated by the administrator to view the \"threats.\"\n\n### 3. Code Flow\n1.  **Entry (Unauthenticated):** An attacker sends a crafted HTTP request that contains a known \"threat\" pattern (e.g., the string `eval(` or `preg_replace(...\u002Fe)`) to trigger the plugin's detection logic defined in `$GLOBALS[\"GOTMLS\"][\"tmp\"][\"definitions_array\"]`.\n2.  **Detection:** The plugin's Firewall\u002FScanner (logic in `images\u002Findex.php`) identifies the \"threat.\"\n3.  **Storage:** The plugin logs the event. It captures the `User-Agent` of the malicious request and stores it using `GOTMLS_update_option('scan_log', ...)`.\n4.  **Admin View:** An administrator navigates to the \"Anti-Malware\" settings page (`\u002Fwp-admin\u002Fadmin.php?page=GOTMLS-settings`).\n5.  **Sink:** The function `GOTMLS_load_scanlog` (or similar logic) retrieves the log data. The stored `User-Agent` is echoed directly into the HTML table of scan results without being passed through `esc_html()` or `esc_attr()`.\n\n### 4. Nonce Acquisition Strategy\nThis vulnerability is exploited by **injecting** data that an administrator will later view. The injection phase is unauthenticated and does not require a nonce.\n\nHowever, if the automated agent needs to verify the injection by simulating an admin view:\n1.  **Identify Variable:** The plugin localizes its settings. Look for a variable like `GOTMLS_objects` or `gotmls_admin_data`.\n2.  **Shortcode:** The plugin primarily operates in the admin backend, but scripts are enqueued via `admin_enqueue_scripts`.\n3.  **Extraction:**\n    *   Navigate to: `\u002Fwp-admin\u002Fadmin.php?page=GOTMLS-settings` (as Admin).\n    *   `browser_eval(\"window.GOTMLS_objects?.nonce\")` (inferred).\n    *   The `GOTMLS_set_nonce` function in `index.php` suggests a custom nonce system: `$head_nonce = GOTMLS_set_nonce(__FUNCTION__.\"100\");`.\n\n### 5. Exploitation Strategy\n\n#### Step 1: Trigger Firewall via User-Agent Injection\nWe send a request that triggers the firewall's \"Potential Threat\" detection by including a signature (like `eval(`) in the query string while placing the payload in the `User-Agent`.\n\n*   **Tool:** `http_request`\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002F?s=eval(base64_decode('...'))`\n*   **Method:** `GET`\n*   **Headers:**\n    *   `User-Agent: \u003Cimg src=x onerror=\"alert('CVE-2026-57691_XSS')\">`\n*   **Expected Response:** The plugin may block the request or simply log the \"Potential Threat.\"\n\n#### Step 2: Trigger Scanner via \"Tagged Code\" (Alternative)\nThe plugin specifically looks for `#TAG# ... #\u002FTAG#` patterns.\n*   **Tool:** `http_request`\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-comments-post.php`\n*   **Method:** `POST`\n*   **Body (URL-encoded):**\n    `comment=#GOTMLS# \u003Cscript>alert(document.domain)\u003C\u002Fscript> #\u002FGOTMLS#&author=Attacker&email=attacker@example.com&comment_post_ID=1`\n\n### 6. Test Data Setup\n1.  Ensure the **Anti-Malware Security and Brute-Force Firewall** plugin is active.\n2.  (Optional) Enable \"Brute-Force Protection\" or \"Firewall\" options if not active by default.\n3.  Create a standard post (ID: 1) to allow comment submission.\n\n### 7. Expected Results\n*   The malicious `User-Agent` or the content within the `#GOTMLS#` tags will be saved in the `GOTMLS_scan_log_blob` or `GOTMLS_settings_array` option in the database.\n*   When the administrator visits the \"Scan Settings\" page, the JavaScript `alert()` will execute in their browser context.\n\n### 8. Verification Steps\n1.  **WP-CLI Check:** Verify the payload is stored in the options.\n    ```bash\n    wp option get GOTMLS_scan_log_blob | grep \"CVE-2026-57691_XSS\"\n    ```\n2.  **Browser Verification:**\n    *   Navigate to `\u002Fwp-admin\u002Fadmin.php?page=GOTMLS-settings`.\n    *   Check for the `alert` box or inspect the DOM for the injected `\u003Cimg>` tag.\n\n### 9. Alternative Approaches\n*   **Request URI Vector:** If the `User-Agent` is sanitized, the plugin also defines `GOTMLS_script_URI` using `$_SERVER[\"REQUEST_URI\"]`. Attempt to inject into a URI fragment that bypasses the `htmlspecialchars` used in `images\u002Findex.php`.\n*   **Referer Vector:** Many security plugins log the `Referer` header. Send the payload in the `Referer` header while triggering a firewall block.","The Anti-Malware Security and Brute-Force Firewall plugin is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) due to insufficient sanitization of the 'mt' request parameter and improper construction of the 'GOTMLS_script_URI' constant. An attacker can inject a malicious payload into the request metadata which is stored in the scan logs and executed when an administrator views the plugin's settings or scan results.","\u002F\u002F images\u002Findex.php line 38\n\"mt\" => ((isset($_REQUEST[\"mt\"])&&GOTMLS_strlen($_REQUEST[\"mt\"])==32)?$_REQUEST[\"mt\"]:md5(microtime(true))),\n\n---\n\n\u002F\u002F images\u002Findex.php line 72\nGOTMLS_define(\"GOTMLS_script_URI\", preg_replace('\u002F\\&(last_)?mt=[0-9\\.a-f]+\u002Fi', '', str_replace('&', '&', GOTMLS_htmlspecialchars($_SERVER[\"REQUEST_URI\"], ENT_QUOTES))).'&mt='.$GLOBALS[\"GOTMLS\"][\"tmp\"][\"mt\"]);","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgotmls\u002F4.23.89\u002Fimages\u002Findex.php\t2026-06-26 12:22:26.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgotmls\u002F4.23.90\u002Fimages\u002Findex.php\t2026-06-29 17:58:10.000000000 +0000\n@@ -35,7 +35,7 @@\n \t\t\"pluginTitle\" => \"Anti-Malware\", \n \t\t\"default_encodings\" => array('UTF-8', 'ISO-8859-1', 'windows-1252'), \n \t\t\"skip_dirs\" => array(\".\", \"..\"), \"scanfiles\" => array(), \"nonce\"=>array(),\n-\t\t\"mt\" => ((isset($_REQUEST[\"mt\"])&&GOTMLS_strlen($_REQUEST[\"mt\"])==32)?$_REQUEST[\"mt\"]:md5(microtime(true))), \n+\t\t\"mt\" => ((isset($_REQUEST[\"mt\"])&&preg_match('\u002F^[0-9\\.a-f]{32}$\u002Fis', $_REQUEST[\"mt\"]))?$_REQUEST[\"mt\"]:md5(microtime(true))), \n \t\t\"threat_files\" => array(\"htaccess\"=>\".htaccess\",\"timthumb\"=>\"thumb.php\"), \n \t\t\"apache\" => array(),\n \t\t\"skip_ext\"=>array(\"png\", \"jpg\", \"jpeg\", \"gif\", \"bmp\", \"tif\", \"tiff\", \"psd\", \"svg\", \"webp\", \"doc\", \"docx\", \"otf\", \"ttf\", \"fla\", \"flv\", \"mov\", \"mp3\", \"mp4\", \"pptx\", \"ppsx\", \"pdf\", \"css\", \"pot\", \"po\", \"mo\", \"so\", \"exe\", \"zip\", \"7z\", \"gz\", \"rar\"),\n@@ -69,7 +69,7 @@\n \t$GLOBALS[\"GOTMLS\"][\"tmp\"][\"protocol\"] = \"https:\";\n else\n \t$GLOBALS[\"GOTMLS\"][\"tmp\"][\"protocol\"] = \"http:\";\n-GOTMLS_define(\"GOTMLS_script_URI\", preg_replace('\u002F\\&(last_)?mt=[0-9\\.a-f]+\u002Fi', '', str_replace('&', '&', GOTMLS_htmlspecialchars($_SERVER[\"REQUEST_URI\"], ENT_QUOTES))).'&mt='.$GLOBALS[\"GOTMLS\"][\"tmp\"][\"mt\"]);\n+GOTMLS_define(\"GOTMLS_script_URI\", preg_replace('\u002F(^|\\&)(last_)?mt=[^\\&]++\u002Fi', '', str_replace('&', '&', GOTMLS_htmlspecialchars($_SERVER[\"REQUEST_URI\"], ENT_QUOTES))).'&mt='.GOTMLS_htmlspecialchars($GLOBALS[\"GOTMLS\"][\"tmp\"][\"mt\"]));\n GOTMLS_define(\"GOTMLS_plugin_home\", \"https:\u002F\u002Fgotmls.net\u002F\");\n if (function_exists(\"plugins_url\"))\n \tGOTMLS_define(\"GOTMLS_images_path\", GOTMLS_fix_url(plugins_url('\u002F', __FILE__)));","The exploit targets the logging mechanism by supplying a malicious 'mt' parameter in an unauthenticated request that triggers a firewall log event. The attacker sends a request to any public page (e.g., `\u002F?s=eval(`) with an `mt` parameter exactly 32 characters long containing an XSS payload (e.g., `\">\u003Cscript>alert(1)\u003C\u002Fscript>AAAA`). Because the plugin only checked for a string length of 32 without validating the characters, this payload is appended to the `GOTMLS_script_URI` constant. When an administrator later views the scan logs in the 'Anti-Malware' settings page, the constant is echoed into the page source without further escaping, triggering the stored JavaScript.","gemini-3-flash-preview","2026-07-15 21:59:49","2026-07-15 22:01:41",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","4.23.89","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgotmls\u002Ftags\u002F4.23.89","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgotmls.4.23.89.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgotmls\u002Ftags\u002F4.23.90","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgotmls.4.23.90.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgotmls\u002Ftags"]