CVE-2026-0739: WMF Mobile Redirector XSS Vulnerability

CVE-2026-0739 Overview

The WMF Mobile Redirector plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the plugin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers with administrative privileges can inject persistent malicious scripts that execute in the context of other users' sessions, potentially leading to session hijacking, administrative account compromise, or further malicious payload delivery.

Affected Products

• WMF Mobile Redirector plugin for WordPress versions up to and including 1.2
• WordPress installations running vulnerable plugin versions
• Websites with administrative users who may have compromised credentials

Discovery Timeline

• January 14, 2026 - CVE-2026-0739 published to NVD
• January 14, 2026 - Last updated in NVD database

Technical Details for CVE-2026-0739

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the WMF Mobile Redirector plugin's options page functionality. The vulnerable code resides in the options-page.php file, specifically around lines 55 and 62 where user-supplied input from plugin settings is processed and rendered without proper sanitization or output encoding.

When an administrator configures the plugin settings, the input values are stored in the WordPress database and subsequently displayed on administrative pages without adequate escaping. This allows malicious JavaScript code to persist in the database and execute whenever any user with access to those pages loads them.

The attack requires the attacker to have Administrator-level access, which limits the initial attack surface. However, in multi-administrator environments or scenarios where admin credentials have been compromised, this vulnerability could be leveraged to maintain persistence, escalate privileges, or compromise other administrative accounts.

Root Cause

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin fails to properly sanitize user input when it is received and fails to escape output when the data is rendered in HTML context. WordPress provides built-in functions such as esc_html(), esc_attr(), and wp_kses() for input sanitization and output escaping, but these appear to be either missing or improperly implemented in the affected code paths within options-page.php.

Attack Vector

The attack is network-based and requires the attacker to have authenticated access with Administrator privileges. The attacker would navigate to the WMF Mobile Redirector plugin settings page and inject malicious JavaScript code into one or more input fields. Once saved, the malicious payload becomes persistent in the WordPress database.

When any user with access to the affected pages loads them, the stored script executes in their browser context. This could be used to steal session cookies, redirect users to phishing pages, modify page content, or perform actions on behalf of the victim user.

The vulnerability allows cross-scope impact, meaning scripts injected by an administrator can potentially affect other administrators or users viewing the affected pages.

Detection Methods for CVE-2026-0739

Indicators of Compromise

• Unexpected JavaScript code or <script> tags present in the wp_options table entries related to wmf-mobile-redirector
• Browser developer tools showing script execution from plugin settings pages that reference external domains
• Audit logs indicating unusual modifications to the WMF Mobile Redirector plugin settings
• User reports of unexpected browser behavior when accessing WordPress admin pages

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS patterns in POST requests to WordPress admin pages
• Configure SentinelOne to monitor for suspicious script injection patterns in web traffic
• Enable WordPress audit logging to track all plugin settings modifications with user attribution
• Perform regular database scans for common XSS payloads in the wp_options table

Monitoring Recommendations

• Monitor HTTP requests to /wp-admin/options-general.php and plugin settings endpoints for XSS payload patterns
• Set up alerts for any modifications to the WMF Mobile Redirector plugin configuration
• Review WordPress user accounts with Administrator privileges and audit their recent activities
• Deploy Content Security Policy (CSP) headers to mitigate the impact of successful XSS exploitation

How to Mitigate CVE-2026-0739

Immediate Actions Required

• Review and audit all current WMF Mobile Redirector plugin settings for suspicious content
• Restrict Administrator-level access to only essential personnel
• Consider temporarily disabling the WMF Mobile Redirector plugin until a patched version is available
• Implement a Web Application Firewall with XSS protection rules

Patch Information

At the time of publication, no official patch has been confirmed. Administrators should monitor the WordPress Plugin Directory and the Wordfence Vulnerability Report for updates regarding a security fix. The vulnerable code can be examined in the WordPress Plugin Source Code.

Workarounds

• Deactivate and remove the WMF Mobile Redirector plugin if it is not essential for site functionality
• Implement strict Content Security Policy headers to prevent inline script execution
• Limit Administrator access and enforce strong authentication including multi-factor authentication
• Use a WordPress security plugin with XSS scanning capabilities to detect malicious content in the database

# Configuration example - Add CSP headers to WordPress via .htaccess
# Add the following to your WordPress root .htaccess file
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"
    Header set X-Content-Type-Options "nosniff"
    Header set X-XSS-Protection "1; mode=block"
</IfModule>