Description

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in the browser of any user visiting the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-12T06:16:25.937Z",
  "pubdate": "2026-09-12T06:16:25.937Z",
  "executiveSummary": "The BE REST Endpoints WordPress plugin through version 1.0.0 contains a critical security flaw involving Broken Access Control and Stored Cross-Site Scripting (XSS).\nThe vulnerability stems from the plugin's REST API endpoints failing to perform any authorization or authentication checks, thereby permitting unauthenticated users to perform CRUD (Create, Read, Update, Delete) operations on site widgets.\nFurthermore, the plugin fails to sanitize user-supplied input stored within these widgets, allowing an attacker to inject arbitrary JavaScript payloads.\nThe impact of this vulnerability is significant, as stored malicious scripts will execute within the context of any user session that views the affected widget, including high-privileged administrator accounts.\nThis allows for session hijacking, administrative action manipulation, or redirection of users to malicious external domains. As exploitation requires no authentication, the risk is severe, allowing remote attackers to compromise the integrity and security of the WordPress installation via the exposed REST API.",
  "technicalDetails": "The vulnerability in the BE REST Endpoints plugin through 1.0.0 originates from a fundamental lack of security controls within the plugin’s REST API implementation. Specifically, the plugin defines custom REST API routes for widget management that bypass WordPress's internal permission checks (e.g., current_user_can('edit_theme_options')).\nBecause these endpoints do not implement callback verification or nonce validation, any unauthenticated remote user can interact with the plugin’s API to create or modify widget content.\nThe core issue is exacerbated by the lack of output sanitization or input validation on the data stored within these widgets. When an attacker sends a crafted request to the REST API, the plugin accepts the payload directly into the database. If an attacker injects a `<script>` or event-based JavaScript payload (e.g., onerror, onload) into a field intended for widget text or settings, the payload is persisted in the site database.\nThe attack flow proceeds as follows: First, the attacker identifies the exposed REST endpoint associated with the BE REST Endpoints plugin. Second, the attacker sends an unauthenticated HTTP POST or PUT request to the endpoint with a malicious XSS payload embedded in the widget parameter. Third, the plugin, failing to perform authorization checks, processes the request and saves the malicious script to the WordPress database. Finally, when an unsuspecting user or administrator visits the site and the widget is rendered, the web browser executes the stored script within the origin of the vulnerable site.\nThe execution of these scripts in the browser of an administrator is particularly critical. Successful exploitation can lead to full site takeover by creating new administrative accounts, modifying plugin settings, or exfiltrating sensitive cookies. The lack of input sanitization provides a direct vector for persistent, stored XSS that persists until the compromised data is manually purged from the database. The exposure is total, as the REST API endpoints are reachable over the public network, requiring no prior knowledge of credentials or site access."
}