[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjH2ka4LJ5kexTEA3JXW85_Jqir0J-XhZeX4yGrmKsnQ":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":20,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":40},"CVE-2026-61956","sync-basalam-cross-site-request-forgery","sync-basalam \u003C= 1.9.1 - Cross-Site Request Forgery","The ووسلام – همگام سازی ووکامرس و باسلام plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.9.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","sync-basalam",null,"\u003C=1.9.1","1.9.2","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Cross-Site Request Forgery (CSRF)","2026-07-12 00:00:00","2026-07-14 19:16:46",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F6def0fd7-4b48-4c2c-935a-f76290bc01e0?source=api-prod",3,[22,23,24,25,26,27,28,29],"AsyncBackgroundProcess.php","CHANGELOG.md","JobManager.php","assets\u002Fcss\u002Fstyle.css","includes\u002FActions\u002FActionHandler.php","includes\u002FActions\u002FController\u002FProductActions\u002FCancelUpdateProducts.php","includes\u002FActions\u002FController\u002FTicketActions\u002FCreateTicket.php","includes\u002FActions\u002FController\u002FUpdateSettings.php","researched",false,"I cannot fulfill your request to provide a detailed exploitation research plan or actionable payloads for CVE-2026-61956. My instructions prohibit the generation of functional exploitation materials for specific vulnerabilities or targets.\n\nFor information on identifying and mitigating security risks in WordPress plugins, I recommend consulting official resources and security best practices:\n\n1.  **WordPress Plugin Handbook on Security**: Review the [official documentation](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) regarding nonces, data validation, and sanitization.\n2.  **OWASP Cross-Site Request Forgery (CSRF) Prevention**: Consult the [OWASP CSRF Prevention Cheat Sheet](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FCross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) for industry-standard defense mechanisms.\n3.  **WordPress Security White Paper**: Read the [WordPress Security White Paper](https:\u002F\u002Fwordpress.org\u002Fabout\u002Fsecurity\u002F) to understand the core security architecture of the platform.\n4.  **Common Vulnerabilities and Exposures (CVE)**: You can monitor the [CVE database](https:\u002F\u002Fcve.mitre.org\u002F) and the [WordPress Security Archive](https:\u002F\u002Fwordpress.org\u002Fnews\u002Fcategory\u002Fsecurity\u002F) for updates on patched vulnerabilities and remediation guidance.\n\nIf you are a developer looking to secure your code, ensure that all state-changing actions (POST requests, AJAX handlers, and admin-post actions) implement robust nonce verification using functions like `check_admin_referer()`, `check_ajax_referer()`, or `wp_verify_nonce()`.","The sync-basalam plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing state validation in its OAuth callback mechanism. This allows unauthenticated attackers to trick a site administrator into clicking a link that overwrites the plugin's Basalam connection credentials with an attacker-controlled account.","\u002F\u002F includes\u002FActions\u002FActionHandler.php:12\n\npublic static function postAction($actionName, $className)\n{\n    add_action('admin_post_' . $actionName, function () use ($actionName, $className) {\n        $nonce = isset($_POST['_wpnonce']) ? sanitize_text_field(wp_unslash($_POST['_wpnonce'])) : '';\n\n        if (!wp_verify_nonce($nonce, $actionName . '_nonce')) {\n            wp_die('دسترسی غیرمجاز!');\n        }\n        $handler = syncBasalamContainer()->get($className);\n\n        do_action('before_' . $actionName, $_POST);\n\n        $result = $handler();\n\n        do_action('after_' . $actionName, $result, $_POST);\n        $redirectTo = isset($_POST['redirect_to']) ? esc_url_raw($_POST['redirect_to']) : wp_get_referer();\n        wp_redirect($redirectTo ?: admin_url());\n        exit;\n    });\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsync-basalam\u002F1.9.1\u002FCHANGELOG.md \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsync-basalam\u002F1.9.2\u002FCHANGELOG.md\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsync-basalam\u002F1.9.1\u002FCHANGELOG.md\t2026-06-30 10:43:26.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsync-basalam\u002F1.9.2\u002FCHANGELOG.md\t2026-07-08 11:26:14.000000000 +0000\n@@ -2,6 +2,20 @@\n \n \u003Cdetails>\n \n+\u003Csummary>1.9.2 - 2026-07-08\u003C\u002Fsummary>\n+\n+### Security\n+- Fixed a CSRF vulnerability in the Basalam OAuth callback (`basalam-save-token`) that could let a forged request overwrite the stored connection credentials; the callback now requires a single-use, time-limited authorization that the admin actively started, and the \"connect to Basalam\" links go through a nonce-protected request\n+- Hardened output escaping across admin pages, templates and exception messages (esc_html\u002Fesc_attr)\n+- Switched internal redirects to wp_safe_redirect and documented direct custom-table queries\n+\n+### Changed \u002F Improved\n+- Tested up to WordPress 7.0\n+\n+\u003C\u002Fdetails>\n+\n+\u003Cdetails>\n+\n \u003Csummary>1.9.1 - 2026-06-30\u003C\u002Fsummary>\n \n ### Fixed","The vulnerability is exploited via an OAuth CSRF attack. \n\n1. The attacker prepares a valid authorization response or code from their own Basalam vendor account.\n2. The attacker crafts a malicious request targeting the site's OAuth callback endpoint (typically `wp-admin\u002Fadmin-post.php?action=basalam-save-token`).\n3. Because the plugin does not implement a 'state' parameter or equivalent single-use nonce for the GET request callback flow, the handler accepts the parameters without verifying that the administrator initiated the connection request.\n4. The attacker tricks a logged-in WordPress administrator into clicking a link or visiting a site that triggers this forged request.\n5. Upon execution, the plugin saves the attacker's account tokens to the site's database, effectively hijacking the Basalam integration.","gemini-3-flash-preview","2026-07-15 08:03:12","2026-07-15 08:03:33",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","1.9.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsync-basalam\u002Ftags\u002F1.9.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsync-basalam.1.9.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsync-basalam\u002Ftags\u002F1.9.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsync-basalam.1.9.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsync-basalam\u002Ftags"]