CVE-2026-42635

Executive Summary

CVE-2026-42635 is an unauthenticated Reflected/Stored Cross-Site Scripting (XSS) vulnerability in the WooCommerce Simple Auctions WordPress plugin, affecting all versions up to and including 3.0.10. The flaw is remotely exploitable without authentication (PR:N) but requires victim user interaction (UI:R) to deliver the malicious script, making it effective against logged-in administrators or site visitors. Successful exploitation allows arbitrary JavaScript execution in the context of the victim's browser session, enabling session theft, credential harvesting, and full site compromise via a chained administrative account takeover. At the time of writing, no public exploit, PoC, or Nuclei template exists, and no vendor patch has been released.

Technical Analysis

CVE-2026-42635 is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The NVD description states the vulnerability is an "Unauthenticated Cross Site Scripting (XSS)" affecting WooCommerce Simple Auctions versions 3.0.10 and earlier. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) confirms the following exploitation characteristics:

• AV:N (Network): The vulnerability is exploitable over the network — no physical or adjacent access is required.
• AC:L (Low Complexity): No specialized conditions or race windows are needed; exploitation is straightforward once a vulnerable input point is identified.
• PR:N (No Privileges Required): The attacker does not need to be authenticated. This is the critical severity driver — any unauthenticated internet user can craft and deliver a malicious payload.
• UI:R (User Interaction Required): Successful exploitation depends on a victim (e.g., a site administrator or a visiting user) interacting with a crafted link or page element.
• S:C (Scope Changed): The impact crosses a security boundary — script execution occurs in the context of the victim's browser and origin, potentially allowing access to resources beyond the vulnerable component itself (e.g., WordPress administrative cookies and nonces).
• C:L/I:L/A:L (Low Confidentiality, Integrity, Availability): The immediate XSS impact is rated Low across all three categories, reflecting that while JavaScript executes in the victim's context, the direct impact on the application server is limited. However, in a WordPress context, XSS against an admin frequently escalates to full site takeover.

The unauthenticated nature of the flaw indicates that at least one input vector — likely a URL parameter, form field, or AJAX-reachable endpoint within the WooCommerce Simple Auctions plugin — fails to sanitize or escape user-supplied input before reflecting it into a response page. Because the NVD description does not disclose the specific parameter, function, or endpoint responsible, no code-level claim about the exact injection point can be substantiated. The attack surface is the publicly reachable WordPress front end where the auction plugin renders dynamic content.

The "Scope Changed" metric is significant: a reflected XSS payload delivered to a WordPress administrator can be leveraged to invoke privileged actions (e.g., creating a new admin user, injecting a backdoor plugin, or modifying theme files) because WordPress admin actions are authorized via cookies and nonces that are accessible to same-origin JavaScript. This elevates what appears to be a low-impact reflected XSS into a potential full compromise chain.

Exploitation Scenarios

No public proof-of-concept (POC) or exploit code exists for CVE-2026-42635 as of this report. The following attack chain is inferred strictly from the vulnerability class (unauthenticated reflected/stored XSS in a WordPress plugin) and the CVSS vector provided. No specific function names, parameter names, file paths, or endpoints are asserted because the NVD description provides none.

1. Reconnaissance / Target Identification: An attacker scans the internet for WordPress installations running the WooCommerce Simple Auctions plugin at version 3.0.10 or below. This is achievable via Shodan queries targeting the plugin's static assets (CSS/JS paths under wp-content/plugins/woocommerce-simple-auctions/) or by fingerprinting page markup unique to the plugin. WordPress REST API enumeration and readme.txt inspection can confirm version.

2. Triggering the Flaw Class: The attacker identifies an unauthenticated input point within the plugin's rendered front-end pages — typically a query string parameter, form POST field, or AJAX action handler that echoes user input back into the HTML response without output encoding. Because the vulnerability is unauthenticated, no login or token is required to reach the vulnerable rendering path.

3. Payload Delivery: The attacker constructs a URL or crafted request embedding a JavaScript payload (e.g., a <script> tag or event-handler attribute) into the vulnerable input. Encoded and obfuscated variants are used to evade naive WAF signatures. The payload executes in the victim's browser when the victim visits the crafted link or views the page reflecting the injected input.

4. Execution and Post-Exploitation Impact: With JavaScript running in the victim's browser origin, the attacker can:

   • Exfiltrate session cookies and WordPress authentication cookies to an attacker-controlled server.
   • Read WordPress nonces from the page and issue authenticated AJAX requests to create administrative users, install malicious plugins, or alter site content.
   • Redirect visitors to phishing or malware-hosting pages.
   • Deface the site or inject persistent SEO spam.
   • If the victim is a site administrator, this typically leads to complete site takeover.

Because no exploit code is public, real-world exploitation would require an attacker to first discover the specific unsanitized parameter through black-box testing or source review. Weaponization effort is low-moderate, but detection of the reconnaissance phase (plugin fingerprinting, fuzzing with XSS polyglots) may precede active exploitation.

Impact Assessment

The CVSS 3.1 base score of 7.1 (High) reflects a network-exploitable, no-privilege, user-interaction-dependent XSS with changed scope. The subscores break down as follows:

• Confidentiality: Low — Attacker can read data accessible to the victim's browser session, including session tokens and page content. In the admin context, this may include sensitive configuration.
• Integrity: Low — Attacker can modify content displayed to or authored by the victim, and — via session riding — potentially change site data through authenticated requests.
• Availability: Low — Attacker can disrupt the victim's interaction with the application, though not the server itself directly.
• Scope: Changed — This is the key risk multiplier. The vulnerable component (the plugin) is not the sole impacted component: the victim's browser security context extends to the WordPress admin domain, enabling cross-boundary impact.

Affected Systems: Any WordPress site running WooCommerce Simple Auctions plugin version 3.0.10 or earlier. WooCommerce auction sites are typically e-commerce platforms hosting user accounts, payment configuration, and customer data — raising the business impact of a takeover.

Blast Radius: The direct blast radius is any authenticated user (especially administrators) who interacts with the crafted payload. The indirect blast radius can include the entire site's user base if the attacker injects persistent (stored) XSS into auction listings or comments, and downstream customers if the site is used to distribute malware or phishing links.

Business Impact: Site defacement, theft of customer PII, financial fraud via compromised admin accounts, SEO poisoning, reputational damage, and regulatory exposure (GDPR/CCPA) if customer data is exfiltrated.

Detection Guidance

Sigma Rule

title: Potential WooCommerce Simple Auctions Unauthenticated XSS Exploitation Attempt
id: 7c9a3e02-4f1b-4e8a-9d2c-1a6b5e8f2c40
status: experimental
description: Detects HTTP requests targeting WooCommerce Simple Auctions plugin endpoints containing common XSS payload patterns.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-42635
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-42635
logsource:
  category: webserver
  product: apache
  service: http
detection:
  selection_plugin:
    cs-uri-query|contains:
      - 'woocommerce-simple-auctions'
      - 'simple_auctions'
      - 'auction'
  selection_xss:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - 'alert('
      - 'document.cookie'
  condition: selection_plugin and selection_xss
falsepositives:
  - Legitimate security scanners
level: high

YARA Rule

rule CVE_2026_42635_WooCommerce_Simple_Auctions_XSS
{
    meta:
        description = "Detects WooCommerce Simple Auctions plugin versions <= 3.0.10 vulnerable markers and XSS payload indicators"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-42635"
        date = "2026-01-01"
        severity = "high"

    strings:
        $plugin = "woocommerce-simple-auctions"
        $ver1 = "Version: 3.0.10"
        $ver2 = "Stable tag: 3.0.10"
        $xss1 = "<script>"
        $xss2 = "onerror="
        $xss3 = "document.cookie"
        $xss4 = "javascript:"

    condition:
        $plugin and 1 of ($ver*) and 1 of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-42635 WooCommerce Simple Auctions Unauthenticated XSS Attempt"; flow:established,to_server; http.uri; content:"woocommerce-simple-auctions"; nocase; http.uri; content:"<script"; nocase; distance:0; sid:2026426350; rev:1; classtype:web-application-attack; reference:cve,2026-42635; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-42635;)

alert http any any -> any any (msg:"CVE-2026-42635 WooCommerce Simple Auctions Encoded XSS Attempt"; flow:established,to_server; http.uri; content:"auction"; nocase; http.uri; content:"%3Cscript"; nocase; distance:0; sid:2026426351; rev:1; classtype:web-application-attack; reference:cve,2026-42635;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where http.request.method == "GET" and
    url.query contains "woocommerce-simple-auctions" or url.query contains "auction"
  ]
  [network where http.request.method in ("GET", "POST") and
    (url.query contains "<script" or
     url.query contains "%3Cscript" or
     url.query contains "onerror=" or
     url.query contains "document.cookie")
  ]

Splunk SPL Query

index=web
| where match(cs_uri_query, "(?i)(woocommerce-simple-auctions|simple_auctions|auction)")
| where match(cs_uri_query, "(?i)(%3Cscript|<script|onerror=|onload=|javascript:|document%2Ecookie|document\.cookie)")
| stats count min(_time) as first_seen max(_time) as last_seen
    values(cs_uri_query) as suspicious_uris
    by src_ip, cs_host
| where count > 0
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve_2026_42635,">
  <rule id="202642635" level="10">
    <if_sid>31100</if_sid>
    <id>^040</id>
    <description>CVE-2026-42635: Possible WooCommerce Simple Auctions unauthenticated XSS attempt (encoded script in request)</description>
    <regex_url>woocommerce-simple-auctions|simple_auctions|auction</regex_url>
    <regex_url>%3Cscript|<script|onerror=|onload=|javascript:|document\.cookie</regex_url>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_42635,web_attack,</group>
  </rule>

  <rule id="202642636" level="12">
    <if_sid>202642635</if_sid>
    <description>CVE-2026-42635: High-confidence WooCommerce Simple Auctions XSS exploitation attempt</description>
    <group>cve_2026_42635,web_attack,critical,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

No vendor fix, workaround, or fixed version has been published for CVE-2026-42635 as of this report. All guidance below is defensive-in-depth based on the vulnerability class.

1) Immediate Mitigations (no patch available):

• Deploy a Web Application Firewall (WAF): Enable or tune WAF rules to block reflected XSS payloads targeting the plugin's request surface. OWASP CRS rules 941100, 941110, 941130, 941160 cover common cross-site scripting patterns including <script>, onerror=, and javascript: payloads.
• Disable the plugin if not essential: If WooCommerce Simple Auctions is not actively required for business operations, deactivate and remove it. This eliminates the attack surface entirely.
• Content Security Policy (CSP) hardening: Deploy a restrictive CSP header (script-src 'self'; object-src 'none') to reduce the impact of any successful XSS, though CSP does not remediate the underlying flaw.
• Restrict administrative access: Limit /wp-admin/ access by IP allowlist or require additional authentication (HTTP basic auth, SSO) so that administrator sessions are less exposed to reflected XSS delivery.
• Educate administrators: Warn site admins against clicking untrusted links, especially those containing auction parameters, while authenticated to WordPress.

2) Patch / Upgrade Steps:

• Monitor the WooCommerce Simple Auctions plugin repository and the vendor's advisory channel for a fixed release above 3.0.10.
• When a patch is released, apply it immediately. Verify the fixed version number from an authoritative source (WordPress plugin repository changelog or vendor advisory) before upgrading; do not assume the next version number.
• Until a patch exists, treat the plugin as vulnerable and rely on WAF and access-control mitigations.

3) Long-Term Hardening:

• Implement an inventory and version-tracking process for all WordPress plugins; subscribe to vulnerability feeds (WPScan, Patchstack, NVD) for real-time alerts.
• Enforce least privilege for WordPress roles; avoid shared admin accounts.
• Adopt a defense-in-depth architecture: WAF + CSP + secure cookie flags (HttpOnly, Secure, SameSite=Strict) to blunt XSS session theft.
• Conduct periodic security reviews and automated plugin vulnerability scans across all WordPress estates.
• Enable comprehensive web server and WordPress audit logging (e.g., Wazuh, Elastic) to detect exploitation attempts that bypass preventive controls.

References

• NVD — CVE-2026-42635: https://nvd.nist.gov/vuln/detail/CVE-2026-42635
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• WordPress Plugin Security / WPScan vulnerability database: https://wpscan.com/plugins (search "WooCommerce Simple Auctions")
• OWASP Cross Site Scripting Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
• CISA KEV Catalog (note: CVE-2026-42635 is NOT listed on CISA KEV as of this report; the catalog is referenced for verification): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, exploit-in-the-wild evidence, or public PoC have been identified for CVE-2026-42635 at the time of publication.