CVE-2026-0555: Premmerce WordPress Plugin XSS Vulnerability

CVE-2026-0555 Overview

The Premmerce plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the premmerce_wizard_actions AJAX endpoint affecting all versions up to and including 1.3.20. The vulnerability arises from missing capability checks combined with insufficient input sanitization and output escaping on the state parameter. This security flaw enables authenticated attackers with subscriber-level access or above to inject arbitrary web scripts into pages that execute whenever a user accesses the affected Premmerce Wizard admin page.

Critical Impact

Authenticated attackers with minimal privileges (subscriber level) can inject persistent malicious scripts that execute in the context of administrator sessions when viewing the Premmerce Wizard admin page, potentially leading to account takeover or sensitive data theft.

Affected Products

• Premmerce WordPress Plugin versions up to and including 1.3.20
• WordPress installations with Premmerce plugin enabled
• Sites allowing subscriber-level user registration

Discovery Timeline

• 2026-02-07 - CVE-2026-0555 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-0555

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists due to a combination of authorization and sanitization failures in the Premmerce WordPress plugin. The premmerce_wizard_actions AJAX endpoint lacks proper capability checks, allowing users with low-privilege accounts (subscriber level and above) to access functionality that should be restricted to administrators.

The state parameter passed to this endpoint is neither properly sanitized on input nor escaped on output. When malicious JavaScript is submitted through this parameter, it gets stored in the database and subsequently rendered without encoding in the Premmerce Wizard admin page. This creates a persistent attack vector where the injected script executes every time an administrator or authorized user views the affected admin interface.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The attack can be executed remotely over the network and requires only basic authentication with subscriber privileges, making it accessible to a wide range of potential attackers on WordPress sites that allow user registration.

Root Cause

The root cause stems from two distinct security failures working in combination:

1. Missing Capability Checks: The AJAX handler in WizardHandler.php fails to verify that the requesting user has appropriate administrative permissions before processing the request. WordPress capability checks (such as current_user_can()) are absent or insufficient, allowing subscribers to invoke administrator-intended functionality.

2. Insufficient Input Validation and Output Escaping: The state parameter is processed and stored without proper sanitization using WordPress functions like sanitize_text_field() or wp_kses(). Additionally, when the stored value is rendered in views/admin/tabs/wizard.php, it is output without proper escaping using functions like esc_attr() or esc_html(), allowing the injected script to execute in the browser.

Attack Vector

The attack leverages the network-accessible AJAX endpoint to deliver the payload. An attacker needs only a valid subscriber-level account on the target WordPress installation. The attack flow proceeds as follows:

1. The attacker authenticates to WordPress with a subscriber account
2. A crafted AJAX request is sent to the premmerce_wizard_actions endpoint with malicious JavaScript in the state parameter
3. The payload is stored in the WordPress database without sanitization
4. When an administrator visits the Premmerce Wizard admin page, the stored script executes in their browser session

The injected script can perform actions with the privileges of the victim user, including creating new administrator accounts, modifying site content, exfiltrating sensitive data, or installing malicious plugins.

For technical implementation details, refer to the WordPress Plugin WizardHandler Code and WordPress Plugin Wizard View Code.

Detection Methods for CVE-2026-0555

Indicators of Compromise

• Unexpected or anomalous AJAX requests to the premmerce_wizard_actions endpoint from non-administrator users
• Suspicious JavaScript code stored in the WordPress database related to Premmerce wizard state data
• Administrator session anomalies following visits to the Premmerce Wizard admin page
• Unauthorized creation of administrator accounts or privilege changes

Detection Strategies

• Monitor WordPress AJAX request logs for premmerce_wizard_actions calls originating from subscriber-level or low-privilege user accounts
• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in AJAX request parameters
• Deploy endpoint detection solutions to identify malicious script execution in administrator browser sessions
• Regularly audit database entries associated with Premmerce plugin for encoded or obfuscated JavaScript content

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX handlers and review logs for suspicious parameter values
• Configure real-time alerting for capability bypass attempts on restricted AJAX endpoints
• Implement Content Security Policy (CSP) headers to mitigate script execution from injected content
• Monitor for unusual administrative actions that may indicate compromised sessions

How to Mitigate CVE-2026-0555

Immediate Actions Required

• Update the Premmerce plugin to a patched version if available (versions after 1.3.20)
• Temporarily disable the Premmerce plugin if an update is not yet available and the functionality is not critical
• Review subscriber and low-privilege user accounts for suspicious activity
• Audit the Premmerce Wizard state data in the database for signs of injected scripts

Patch Information

Refer to the Wordfence Vulnerability Report for the latest patch status and remediation guidance from the plugin vendor. Update to the latest version of the Premmerce plugin as soon as a security fix is released. The vulnerable code locations can be reviewed in the WordPress plugin repository at Admin.php and WizardApi.php.

Workarounds

• Restrict user registration on affected WordPress sites to prevent attackers from obtaining subscriber accounts
• Implement additional access controls via security plugins to limit AJAX endpoint access to administrators only
• Deploy a Web Application Firewall with XSS filtering rules to block malicious payloads targeting this endpoint
• Consider removing or replacing the Premmerce plugin until a patched version is available

# WordPress configuration to restrict user registration
# Add to wp-config.php to limit new registrations while vulnerable
define('WP_ALLOW_MULTISITE', false);

# Or via wp-admin: Settings -> General -> uncheck "Anyone can register"
# Additionally, review existing subscriber accounts for suspicious users