WP Real IP-based Access Control <= 1.3.1 – Unauthenticated Stored XSS via acl_ctrl_addr | CVE 2026-14592

Description

The plugin does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in the context of any administrator who views the page.

Proof of Concept

The plugin's admin file (get-real-ip-admin.php) performs a top-level option write on every admin-side request: it is included whenever is_admin() is true, which includes wp-admin/admin-ajax.php. There is no capability check and no nonce check, and admin-ajax.php is reachable without authentication.

1. As an unauthenticated attacker, store the payload by POSTing acl_ctrl_addr to admin-ajax.php (no login and no valid action are required):

   curl -sk \
     --data-urlencode 'acl_ctrl_addr=</textarea><script>alert(document.domain)</script>' \
     "https://victim.example/wp-admin/admin-ajax.php"

   The response is HTTP 400 with body "0". This is admin-ajax's reply for an unmatched action and does NOT indicate failure: the option write executes at plugin-load time, before admin-ajax dispatches, so the payload is already stored in the acl_ctrl_addr option.

2. When an administrator opens the plugin settings page:

   /wp-admin/options-general.php?page=get-real-ip-admin.php

   the stored value is echoed unescaped inside a <textarea>, so the payload breaks out of the textarea and the injected <script> runs in the administrator's browser session.

Note: use a quote-free payload (as above) so WordPress magic quotes does not add backslashes to the stored value.