CVE-2026-87786 Overview
CVE-2026-87786 is a stored cross-site scripting (XSS) vulnerability in the Dewa Kirim WordPress plugin through version 1.0.0. The plugin fails to escape delivery coordinates submitted at checkout before writing them inside an inline script tag. Unauthenticated shoppers can inject JavaScript that executes when an administrator later views the order in the WordPress dashboard. Execution in an administrator session enables account takeover, plugin installation, and pivoting deeper into the site. The flaw is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation and is documented in the WPScan Vulnerability Report.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an authenticated administrator's browser, leading to full WordPress site compromise.
Affected Products
- Dewa Kirim WordPress plugin, all versions through 1.0.0
- WordPress sites using Dewa Kirim for shipping/delivery coordination at checkout
- Any storefront where administrators review orders submitted by unauthenticated buyers
Discovery Timeline
- 2026-09-17 - CVE-2026-87786 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-87786
Vulnerability Analysis
The Dewa Kirim plugin collects delivery coordinates during the WordPress checkout flow and stores them with the order record. When an administrator opens the order in wp-admin, the plugin emits those coordinates directly into an inline <script> block without escaping. Because the injection point is inside JavaScript context rather than HTML body content, standard HTML entity escaping is insufficient. Attackers can terminate the current statement and append arbitrary JavaScript that executes with administrator privileges.
Once triggered, the injected script runs in the same origin as the WordPress dashboard. Attackers commonly use this position to create new administrator users, install malicious plugins, or exfiltrate session cookies and nonces. The attack requires no authentication and no interaction from the victim beyond opening the order page.
Root Cause
The root cause is missing output encoding on untrusted checkout input before it is written into a JavaScript context. WordPress provides esc_js() for values placed inside inline scripts, but the plugin does not apply it to the coordinate fields. Coordinate fields are also not constrained to numeric input on the server side, so arbitrary strings are accepted and stored.
Attack Vector
An unauthenticated attacker completes a checkout on a site running Dewa Kirim and supplies a crafted coordinate value containing JavaScript payload characters. The payload is stored with the order. When any administrator later views the order in the dashboard, the browser parses the inline script and executes the attacker-supplied code with administrator privileges.
No verified proof-of-concept code is published for this CVE. See the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-87786
Indicators of Compromise
- Order records in wp_postmeta containing coordinate fields with characters such as <, >, ", ', or the substrings </script>, onerror=, or javascript:.
- Unexpected administrator accounts created shortly after an administrator viewed a customer order.
- Outbound requests from an administrator browser session to unfamiliar domains immediately after loading an order page.
- New or modified plugin files installed without a corresponding entry in the site change log.
Detection Strategies
- Query the WordPress database for order meta values containing HTML or JavaScript syntax in delivery coordinate fields.
- Enable a Content Security Policy in report-only mode on wp-admin and review violation reports for inline script executions tied to order pages.
- Correlate WordPress audit logs of user_register and activate_plugin events with recent administrator visits to order detail pages.
Monitoring Recommendations
- Alert on creation of administrator-role accounts outside of change windows.
- Monitor web server logs for checkout submissions with anomalous payload lengths or non-numeric characters in coordinate parameters.
- Track file integrity on wp-content/plugins/ and wp-content/mu-plugins/ for unexpected additions.
How to Mitigate CVE-2026-87786
Immediate Actions Required
- Deactivate the Dewa Kirim plugin until a patched version is available.
- Audit all existing orders for stored payloads in delivery coordinate fields and sanitize or delete affected records.
- Rotate administrator passwords and force reauthentication for all wp-admin sessions.
- Review the WordPress user list and remove any unauthorized administrator accounts.
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. The vulnerability affects the Dewa Kirim plugin through version 1.0.0. Monitor the WPScan Vulnerability Report and the WordPress plugin repository for a fixed release.
Workarounds
- Restrict access to the checkout endpoint behind a web application firewall rule that rejects HTML and JavaScript metacharacters in coordinate fields.
- Deploy a strict Content Security Policy on wp-admin that disallows inline scripts to blunt exploitation.
- Use a staff account with reduced privileges for reviewing new orders until the plugin is patched.
# Example WAF rule concept: reject checkout submissions where coordinate fields contain script syntax
# ModSecurity-style pseudo-rule
SecRule ARGS:coordinates|ARGS:lat|ARGS:lng "@rx (?i)(<script|</script|onerror=|javascript:|<img)" \
"id:1087786,phase:2,deny,status:403,msg:'Blocked possible XSS in Dewa Kirim coordinates (CVE-2026-87786)'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
