CVE-2026-81742: BE REST Endpoints WordPress Plugin XSS

CVE-2026-81742 Overview

CVE-2026-81742 affects the BE REST Endpoints WordPress plugin through version 1.0.0. The plugin exposes REST API endpoints for widget management without performing any authorization checks. Unauthenticated attackers can read, create, update, and delete widgets through these endpoints. The plugin also fails to sanitize values stored in widgets, enabling stored Cross-Site Scripting (XSS) attacks [CWE-79]. Injected scripts execute in the browser of any visitor to the affected site, including administrators. This combination of broken access control and missing input sanitization enables complete site compromise through session hijacking or administrative account takeover.

Critical Impact
Unauthenticated attackers can inject arbitrary JavaScript into WordPress widgets, executing malicious code in every site visitor's browser, including logged-in administrators.

Affected Products

BE REST Endpoints WordPress plugin versions through 1.0.0
WordPress sites with the plugin installed and activated
Any browser rendering pages containing compromised widgets

Discovery Timeline

2026-09-12 - CVE-2026-81742 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-81742

Vulnerability Analysis

The BE REST Endpoints plugin registers WordPress REST API routes for widget operations without applying a permission_callback that validates the requester's identity or capabilities. WordPress REST route registration requires an explicit permission callback to enforce authorization. Returning true or omitting the check exposes the endpoint to unauthenticated requests.

The second flaw compounds the first. Widget values submitted through these endpoints are stored directly in the database without sanitization functions such as sanitize_text_field(), wp_kses_post(), or equivalent encoding on output. Attackers can submit payloads containing <script> tags or event handlers that persist across sessions and render on any page displaying the widget.

Root Cause

Two distinct defects combine to produce the impact. The first is a missing authorization control on REST endpoints [CWE-862 pattern within CWE-79 chain]. The second is improper neutralization of input during web page generation [CWE-79]. Neither defense in depth mechanism is present, so a single request achieves both persistence and execution.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a crafted HTTP request to the vulnerable REST endpoint containing JavaScript within a widget field. The payload persists in the database and executes when any user, including administrators, loads a page that renders the widget. The user interaction requirement in the CVSS vector reflects the need for a victim to visit the compromised page for script execution.

Exploitation of this vulnerability is described in the WPScan Vulnerability Advisory. No verified public proof-of-concept code is currently referenced in the CVE data.

Detection Methods for CVE-2026-81742

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handlers such as onerror and onload within widget content stored in the wp_options or wp_widgets tables.
POST, PUT, or DELETE requests to REST endpoints registered by the BE REST Endpoints plugin originating from unauthenticated sources.
Newly created or modified widgets that no administrator recalls configuring.
Outbound requests from visitor browsers to unfamiliar domains after loading pages containing widgets.

Detection Strategies

Inspect web server access logs for requests to /wp-json/ routes associated with the plugin, particularly those without valid authentication cookies or nonces.
Query the WordPress database for widget content containing HTML tags or JavaScript syntax that should not appear in legitimate widget data.
Deploy a Web Application Firewall (WAF) rule to flag REST API calls carrying script payloads in request bodies.

Monitoring Recommendations

Enable WordPress audit logging to capture widget creation, modification, and deletion events with source IP attribution.
Monitor for anomalous outbound connections from client browsers accessing the WordPress site.
Alert on installation or activation of the BE REST Endpoints plugin across managed WordPress environments.

How to Mitigate CVE-2026-81742

Immediate Actions Required

Deactivate and remove the BE REST Endpoints plugin from all WordPress installations until a patched version is confirmed available.
Audit existing widgets for injected script content and remove any unauthorized entries.
Rotate WordPress administrator credentials and invalidate active sessions if evidence of exploitation exists.
Review user accounts for unauthorized additions or privilege changes that could indicate successful administrator session hijacking.

Patch Information

The CVE data lists the plugin as vulnerable through version 1.0.0 and does not reference an available fixed version. Consult the WPScan Vulnerability Advisory for the current patch status. If no patched release is available, treat removal as the primary remediation.

Workarounds

Block access to the plugin's REST API routes at the web server or WAF layer for all unauthenticated clients.
Restrict /wp-json/ endpoints to authenticated users with appropriate capabilities using access control rules.
Apply a Content Security Policy (CSP) header that limits inline script execution to reduce the impact of injected payloads.
Restore widget content from a known-clean backup after removing the plugin.

bash

# Example nginx rule to block unauthenticated access to plugin REST routes
location ~* /wp-json/be-rest-endpoints/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}