CVE-2026-18317: Foxtool WordPress Plugin Auth Bypass Flaw

CVE-2026-18317 Overview

CVE-2026-18317 is an authorization bypass vulnerability in the Foxtool All-in-One WordPress plugin, affecting all versions up to and including 2.5.3. The plugin fails to verify that a user is authorized before allowing modifications to subkeys of the foxtool_settings option. Authenticated users with subscriber-level access or higher can toggle the media-up3 key to enable site-wide Scalable Vector Graphics (SVG) uploads. This capability facilitates stored cross-site scripting (XSS) through malicious SVG files uploaded to the site. The weakness is categorized under CWE-862: Missing Authorization.

Critical Impact

Low-privileged subscribers can modify plugin settings to enable SVG uploads, opening a path to stored XSS execution in administrator browser sessions.

Affected Products

• Foxtool All-in-One WordPress plugin versions ≤ 2.5.3
• WordPress sites with subscriber registration enabled
• Sites relying on the foxtool_settings option for media handling controls

Discovery Timeline

• 2026-09-18 - CVE-2026-18317 published to the National Vulnerability Database (NVD)
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-18317

Vulnerability Analysis

The Foxtool plugin exposes handlers that update entries within the foxtool_settings WordPress option without validating the caller's capability. The vulnerable logic resides in inc/media.php, referenced at lines 854, 868, and 926 in the plugin source tree. Any authenticated session, including a subscriber, can invoke these handlers and mutate arbitrary subkeys.

Toggling the media-up3 key enables SVG uploads across the site. SVG files are XML documents that can carry <script> elements or event handlers. When an administrator later views the uploaded asset in the media library or on a rendered page, the embedded JavaScript executes in their session context. The attack chain converts a settings-tampering primitive into stored XSS with administrator reach.

Root Cause

The root cause is missing authorization enforcement on settings-modification endpoints. The plugin verifies that the request is authenticated but omits a current_user_can() capability check before persisting subkey updates. This design flaw treats any logged-in user as trusted for administrative configuration changes.

Attack Vector

Exploitation requires network access and valid subscriber credentials. The attacker submits a request to the vulnerable plugin endpoint, setting media-up3 to true within foxtool_settings. Once SVG uploads are permitted, the attacker uploads a crafted SVG containing JavaScript. Subsequent administrator interaction with the file triggers script execution. See the Wordfence Vulnerability Report for additional context.

// No verified proof-of-concept is published. Refer to the plugin source references
// for the specific handler logic that omits capability checks.

Detection Methods for CVE-2026-18317

Indicators of Compromise

• Unexpected changes to the foxtool_settings option, particularly the media-up3 subkey being set to enabled
• Presence of .svg files in wp-content/uploads/ containing <script> tags or on* event handlers
• Media library entries uploaded by subscriber-level accounts
• Administrator sessions exhibiting unexpected outbound requests after viewing media assets

Detection Strategies

• Audit the wp_options table for modifications to foxtool_settings and diff against a known-good baseline
• Scan uploaded SVG files for embedded scripting content using an SVG sanitizer or static analysis
• Review WordPress access logs for POST requests to Foxtool admin-ajax or REST endpoints originating from low-privilege accounts

Monitoring Recommendations

• Log all changes to WordPress options containing plugin configuration and alert on modifications by non-administrator users
• Monitor new user registrations followed by immediate settings or media activity
• Track file uploads by MIME type and flag SVG uploads for review when they originate from non-editor roles

How to Mitigate CVE-2026-18317

Immediate Actions Required

• Update the Foxtool plugin to a version above 2.5.3 that includes the fix from the plugin changeset
• Audit the foxtool_settings option and reset media-up3 to disabled unless SVG uploads are required
• Review all SVG files in the media library and remove any containing scripting content
• Disable open user registration or restrict the default new-user role to prevent easy subscriber creation

Patch Information

The vendor addressed the issue in a subsequent Foxtool release following version 2.5.3. The corrective patch is tracked in the WordPress plugin changeset referenced above and adds proper capability validation to the affected handlers in inc/media.php.

Workarounds

• Deactivate the Foxtool plugin until the patched version is deployed
• Apply a Web Application Firewall (WAF) rule that blocks unauthenticated or low-privilege requests targeting the plugin's settings endpoints
• Enforce server-side SVG sanitization or block SVG uploads entirely via upload_mimes filter

# Restrict SVG uploads via a mu-plugin filter
add_filter('upload_mimes', function($mimes) {
    unset($mimes['svg']);
    unset($mimes['svgz']);
    return $mimes;
});