CVE-2026-15385

The vulnerability stems from a fundamental confusion in WordPress AJAX development: nonce verification confirms that a request originated from an authenticated user session, but it does not authorize what that user can do. The plugin in question registered an AJAX action that performed capability checking by calling check_ajax_referer() alone—which validates the nonce and terminates on failure—but never invoked current_user_can() to verify the requester's actual privileges. The result is that any logged-in user, including a subscriber (WordPress's lowest role, available via self-registration on most sites), could trigger the endpoint. A subscriber can obtain a valid nonce by simply visiting any admin page, then use it to inject arbitrary content into the plugin's stored data. That stored content is then rendered with a second failure: unescaped output placed directly into a style attribute. The CSS context creates a breakout vector—while property values aren't HTML, they can break into event handlers, allowing stored JavaScript execution. When an administrator later visits a page displaying the poisoned data, the payload runs in an authenticated admin session, enabling full site compromise including credential theft and further plugin installation. The CVSS 5.4 rating misrepresents the actual risk by treating 'authenticated user' as a significant barrier. A subscriber account requires no privilege escalation and no special access—the attack surface is anyone who can register on the site. The authorization bypass amplifies the stored XSS into admin-session takeover, a cascading impact path that single-metric severity scores cannot represent. Check your AJAX handlers: if they rely solely on nonce verification, add explicit capability checks using current_user_can() with the minimum required capability for the operation. Verify that any data rendered into style attributes uses proper escaping—css属性需要经过esc_attr()但更关键的是避免将用户输入直接放入style属性，优先使用更安全的CSS类切换机制而非内联样式注入。

Reviewed through automated stages and approved by a human before publication.