CVE-2026-103899

Executive Summary

CVE-2026-103899 is a stored cross-site scripting (XSS) vulnerability in the "EU VAT Assistant for WooCommerce" WordPress plugin, affecting all versions up to and including 2.1.30.260413. The flaw allows unauthenticated attackers to inject arbitrary web scripts via the vat_number parameter due to insufficient input sanitization and output escaping. The injected payload executes in the administrator's browser when an order is reviewed under WooCommerce → Orders → Edit Order, enabling privilege escalation to full site takeover through rogue administrator account creation. No public exploit or patch is currently available.

Technical Analysis

The vulnerability resides in the handling of the vat_number parameter, a customer-supplied field collected during the WooCommerce checkout process. Because the plugin fails to sanitize this input on submission and fails to escape it on output, an attacker can store a malicious JavaScript payload that persists in the application database. The core mechanism is a classic CWE-79 stored XSS: user-controlled input flows into a page rendered to a higher-privileged user without encoding.

The attack surface is the order management interface. When an administrator navigates to WooCommerce → Orders → Edit Order to review an order containing a tainted vat_number value, the browser renders the unsanitized value and executes the embedded script in the administrator's authenticated session context. This is significant because the execution context is the admin dashboard, which grants the script access to administrative nonces, session cookies (subject to HttpOnly flags), and privileged AJAX endpoints.

The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (score 7.2) reflects: network attack vector, low attack complexity, no privileges required (unauthenticated injection), no user interaction required for the injection itself, and a changed scope — the vulnerable component (checkout input handling) impacts a separate security authority (the administrator's browser session). Confidentiality and integrity impacts are low per CVSS scoring, but the practical consequence of privilege escalation to site takeover substantially elevates real-world risk. The UI:N metric reflects that the attacker does not need to interact with the victim; however, exploitation still depends on an administrator later opening the tainted order record — an operational dependency rather than a scoring one.

The absence of CNA-provided title and affected-version metadata, combined with zero patch confidence across all tracked sources, indicates the vulnerability is either newly disclosed or the vendor has not issued a fix. No public PoC, Nuclei template, or exploit code is available, so the technical analysis is necessarily bounded by the NVD description; implementation-level details such as specific function names, file paths, or AJAX handlers cannot be confirmed and are not asserted here.

Exploitation Scenarios

1. Reconnaissance / target identification. An attacker identifies WordPress sites running WooCommerce with the EU VAT Assistant plugin. Because the plugin targets EU VAT compliance, targets of interest are e-commerce stores selling into the EU. Fingerprinting can be performed via Shodan dorks or by enumerating plugin assets under wp-content/plugins/.

2. Triggering the flaw class. The attacker interacts with the checkout/order flow and submits a vat_number value containing a script payload. Since the plugin does not sanitize the input, the payload is persisted. No authentication is required, meaning the attacker can complete this step as an anonymous shopper or via automated requests.

3. Payload execution. The stored payload remains dormant until an administrator opens the affected order in WooCommerce → Orders → Edit Order. At that point the script executes in the administrator's browser context. At the vulnerability-class level, the payload can perform actions as the admin: creating a new administrator account, modifying plugin/site settings, or exfiltrating session tokens to an attacker-controlled server.

4. Post-exploitation impact. Successful execution permits privilege escalation up to full site takeover, most directly through rogue administrator account creation as stated in the NVD description. From a compromised administrator account, an attacker could install malicious plugins, alter site content, and pivot to customers' stored data (including VAT and order records).

No public PoC is available; the attack chain above is inferred strictly from the vulnerability class and the NVD description.

Impact Assessment

Business impact is high for affected e-commerce operators. A successful exploit leads to full site compromise, enabling defacement, data theft (customer PII, VAT records, order histories), malware injection into the storefront, and potential regulatory exposure under GDPR given the EU VAT context. The blast radius extends to all customers whose data transits the compromised store and to any integrations (payment processors, ERP connectors) tied to the WordPress installation.

CVSS subscores: Confidentiality Low, Integrity Low, Availability None — but because scope is Changed and the vulnerability enables administrative takeover, the operational severity exceeds the raw 7.2 base score. The unauthenticated (PR:N) and no-interaction (UI:N) characteristics lower the barrier to entry, while the stored nature of the flaw means a single injection can compromise multiple administrators who review the same order. EPSS is not yet scored; CISA KEV status is NO, indicating no confirmed in-the-wild exploitation at time of writing.

Detection Guidance

Sigma Rule

title: Stored XSS via EU VAT Assistant vat_number Parameter
id: 8f3a2c1e-4b7d-4e9a-9c2f-1d6e5a0b7c34
status: experimental
description: Detects submission of script payloads in the vat_number parameter targeting the EU VAT Assistant for WooCommerce plugin.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103899
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - POST
      - GET
  selection_param:
    c-uri|contains: 'vat_number'
  selection_payload:
    c-uri|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '%3Cscript'
  condition: selection_method and selection_param and selection_payload
falsepositives:
  - Legitimate VAT numbers containing special characters (rare)
level: high

YARA Rule

rule CVE_2026_103899_VAT_XSS
{
    meta:
        description = "Detects stored XSS payloads in WooCommerce order data via vat_number parameter"
        cve = "CVE-2026-103899"
        author = "Threat Intelligence"
    strings:
        $vat = "vat_number" ascii wide nocase
        $s1 = "<script" ascii wide nocase
        $s2 = "javascript:" ascii wide nocase
        $s3 = "onerror=" ascii wide nocase
        $s4 = "onload=" ascii wide nocase
        $s5 = "document.cookie" ascii wide nocase
    condition:
        $vat and any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103899 EU VAT Assistant WooCommerce Stored XSS vat_number"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"vat_number"; nocase; http.client_body; content:"<script"; nocase; classtype:web-application-attack; reference:cve,2026-103899; sid:2026103899; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [any where event.category == "web" and http.request.method == "POST" and
     stringContains(to_lower(url.query or ""), "vat_number") and
     (stringContains(to_lower(request.body.content or ""), "<script") or
      stringContains(to_lower(request.body.content or ""), "onerror=") or
      stringContains(to_lower(request.body.content or ""), "javascript:"))]

Splunk SPL Query

index=web sourcetype=access_combined (uri="*vat_number*" OR form_data="*vat_number*")
| eval suspicious=if(match(_raw,"(?i)(<script|javascript:|onerror=|onload=)"),"yes","no")
| where suspicious="yes"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip
| convert ctime(first_seen) ctime(last_seen)
| sort -count

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="103899" level="12">
    <if_sid>31108,31103</if_sid>
    <url type="pcre2">(?i)vat_number</url>
    <match type="pcre2">(?i)(&lt;script|javascript:|onerror=|onload=)</match>
    <description>CVE-2026-103899: Potential stored XSS via EU VAT Assistant vat_number parameter</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Deploy a Web Application Firewall (WAF) rule to inspect and block script tokens (<script, javascript:, onerror=) in requests containing the vat_number parameter. Enforce strict Content Security Policy headers. Restrict the administrator role to trusted users and monitor administrative account creation events. Consider temporarily disabling the plugin if the risk is unacceptable.
2. Patch/upgrade steps. No vendor fix is currently available. Monitor the plugin vendor's release channel and the WordPress plugin repository for a patched version beyond 2.1.30.260413. When released, test and deploy promptly; verify the fix addresses both input sanitization and output escaping of the vat_number field.
3. Long-term hardening. Apply a defense-in-depth posture: least-privilege WordPress roles, mandatory Content Security Policy, regular plugin inventory audits with removal of unnecessary plugins, and continuous monitoring for stored XSS via log and database scanning. Establish a vendor-notification workflow to shorten exposure windows for e-commerce plugin vulnerabilities, and maintain off-site backups to recover from defacement or rogue-account incidents.

References

• NVD — CVE-2026-103899: https://nvd.nist.gov/vuln/detail/CVE-2026-103899
• MITRE CWE-79 (Improper Neutralization of Input During Web Page Generation): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059.007 (Command and Scripting Interpreter: JavaScript): https://attack.mitre.org/techniques/T1059/007/
• FIRST EPSS: https://www.first.org/epss/ (not yet scored at time of writing)
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not listed)
• WooCommerce Orders documentation: https://woocommerce.com/document/managing-orders/

No threat actor campaigns or exploit-in-the-wild evidence have been identified for this CVE as of the data provided. No public PoC or Nuclei template exists.