CVE-2026-9626 Overview
CVE-2026-9626 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the JSON API User plugin for WordPress. The flaw affects all versions up to and including 4.1.0. Attackers with subscriber-level access can inject arbitrary JavaScript through the content parameter of the post_comment API endpoint. The post_comment() function passes the attacker-controlled comment_content value directly to wp_insert_comment() without HTML sanitization. Callers can also set comment_approved=1 to self-approve comments, bypassing moderation. Injected scripts execute in the browser of any user who views the affected page.
Critical Impact
Authenticated subscribers can persist arbitrary JavaScript into WordPress pages, enabling session theft, forced administrative actions, and site defacement against visitors and administrators.
Affected Products
- JSON API User plugin for WordPress, versions up to and including 4.1.0
- WordPress sites using the vulnerable plugin with open user registration or subscriber accounts
- Fixed in JSON API User 4.1.2
Discovery Timeline
- 2026-07-03 - CVE-2026-9626 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-9626
Vulnerability Analysis
The vulnerability lives in the post_comment() handler of the JSON API User plugin controller (controllers/User.php). The handler accepts a content parameter from an authenticated caller and forwards it into wp_insert_comment() as comment_content. WordPress core relies on the calling code to sanitize HTML before insertion, but the plugin performs no filtering. As a result, <script> tags and event handlers persist verbatim in the comments table. When a page rendering those comments loads, the browser executes the stored payload in the site's origin.
A second design flaw compounds the primary issue. The endpoint honors a client-supplied comment_approved field, allowing the attacker to set it to 1. This bypasses the moderation queue that would otherwise expose the payload to an administrator before publication. Subscribers - the lowest privileged authenticated role that can register on many sites - can therefore publish executable content without any review.
Root Cause
The root cause is missing output-context sanitization on user input combined with unauthenticated trust of a moderation flag. The plugin should apply wp_filter_comment() or wp_kses() to comment content and must not accept comment_approved from client input. Both requirements are documented WordPress API expectations.
Attack Vector
An attacker registers or authenticates as a subscriber, then issues a request to the post_comment endpoint with a malicious content value and comment_approved=1. No user interaction is required to store the payload. When any visitor or administrator later loads the target post or comment feed, the script executes with the privileges of the viewing session. The vulnerability is described in prose only - see the WordPress User Controller Code and the Wordfence Vulnerability Report for source-level detail.
Detection Methods for CVE-2026-9626
Indicators of Compromise
- Comment rows in wp_comments containing <script>, onerror=, onload=, or javascript: in the comment_content column.
- Requests to /?json=user/post_comment or the plugin's REST route with a content parameter carrying HTML or JavaScript.
- Comments authored by subscriber accounts with comment_approved=1 that never passed through the moderation queue.
Detection Strategies
- Query the WordPress database for comments containing HTML tags authored by low-privilege users since the plugin was installed.
- Inspect web server access logs for POST requests to the json-api-userpost_comment endpoint originating from newly registered subscriber accounts.
- Deploy web application firewall rules that block payloads containing script tags or JavaScript URI schemes submitted to the plugin's API routes.
Monitoring Recommendations
- Alert on bursts of new subscriber registrations followed by immediate post_comment API calls.
- Monitor for outbound requests from browsers visiting the affected site to unexpected domains, indicating exfiltration by an injected script.
- Track modifications to the wp_comments table outside of the standard admin comment workflow.
How to Mitigate CVE-2026-9626
Immediate Actions Required
- Update the JSON API User plugin to version 4.1.2 or later on all WordPress installations.
- Audit the wp_comments table for HTML or JavaScript content and remove or sanitize any malicious entries.
- Rotate administrator sessions and credentials if evidence of script execution against privileged users is present.
Patch Information
The vendor addressed the issue in JSON API User 4.1.2. Review the WordPress User Controller Changeset and the WordPress User Plugin Version Update for the exact fix.
Workarounds
- Disable the JSON API User plugin until the update is applied.
- Restrict new user registration or set the default role to a value that cannot reach authenticated plugin endpoints.
- Deploy a WAF rule blocking script tags and JavaScript URI schemes in requests to the post_comment route.
# Configuration example: force plugin update via WP-CLI
wp plugin update json-api-user --version=4.1.2
wp plugin list --name=json-api-user --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
