Executive brief
The Word 2 Cash plugin for WordPress, which helps site owners monetize content, contains a security flaw that allows attackers to hijack an administrator's session. By tricking a logged-in admin into clicking a malicious link, an attacker can inject harmful scripts into the website's settings. This could lead to unauthorized changes to the site, theft of sensitive information, or full administrative takeover when the settings page is viewed.
Technical details
The vulnerability exists in the w2c_admin() function due to a complete lack of nonce verification on the settings save handler. Additionally, the plugin fails to sanitize the 'w2c-definitions' POST parameter before saving it via update_option() and fails to escape the output when rendering it within a textarea element. An unauthenticated attacker can exploit this by tricking an authenticated administrator into submitting a specially crafted request (CSRF). This results in a stored XSS payload that executes in the context of the administrator's browser whenever they visit the plugin's settings page.
Affected products
- Word 2 Cash Word 2 Cash up to and including 0.9.2
Timeline
- 2026-05-20: disclosed: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/word-2-cash/tags/0.9.2/word2cash.php
- https://plugins.trac.wordpress.org/browser/word-2-cash/tags/0.9.2/word2cash.php
- https://plugins.trac.wordpress.org/browser/word-2-cash/tags/0.9.2/word2cash.php
- https://plugins.trac.wordpress.org/browser/word-2-cash/trunk/word2cash.php
- https://plugins.trac.wordpress.org/browser/word-2-cash/trunk/word2cash.php
- https://plugins.trac.wordpress.org/browser/word-2-cash/trunk/word2cash.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e4c7ca5c-38aa-4413-83eb-29185cca2a74?source=cve