# WebPurify WordPress Plugin Security Vulnerability Fix
## CVE-2026-0572

---

## Vulnerability Overview

**Severity:** Medium (CVSS 6.5/10)  
**Affected Versions:** All versions up to and including 4.0.2  
**Vulnerability Type:** Missing Capability Check / Unauthorized Data Modification  
**Attack Vector:** Network-based, unauthenticated

### The Problem

The `webpurify_save_options()` function in `webpurifytextreplace-options.php` (line 92) lacks proper security checks, allowing **any unauthenticated user** to modify plugin settings by sending a POST request to the WordPress admin.

---

## Security Risks

### What an Attacker Can Do:
1. **Modify API Keys** - Change or steal the WebPurify API key
2. **Disable Filtering** - Turn off profanity filtering completely
3. **Change Filter Settings** - Alter how content is filtered
4. **Potential XSS** - If custom replacement text isn't properly sanitized

### Real-World Impact:
- Unauthorized access to premium API services
- Bypassing content moderation on your site
- Potential data exposure through API key theft
- Compliance issues if filtering is required by policy

---

## The Fix - Two Critical Security Measures

### 1. Capability Check
```php
if (!current_user_can('manage_options')) {
    wp_die(__('You do not have sufficient permissions to access this page.'));
}
```

**What it does:** Ensures only WordPress administrators can save settings  
**Why it's critical:** Without this, ANY visitor (even not logged in) can modify settings

### 2. Nonce Verification (CSRF Protection)
```php
if (!isset($_POST['webpurify_nonce']) || 
    !wp_verify_nonce($_POST['webpurify_nonce'], 'webpurify_save_options')) {
    wp_die(__('Security check failed. Please try again.'));
}
```

**What it does:** Verifies the form submission is legitimate  
**Why it's critical:** Prevents Cross-Site Request Forgery (CSRF) attacks

### 3. Nonce Field in Form
```php
<?php wp_nonce_field('webpurify_save_options', 'webpurify_nonce'); ?>
```

**What it does:** Generates a unique token for each form  
**Why it's critical:** The token is validated on submission to ensure authenticity

---

## Before vs After

### VULNERABLE CODE (Before):
```php
function webpurify_save_options() {
    // No security checks!
    
    // Directly save posted data
    if (isset($_POST['webpurify_api_key'])) {
        update_option('webpurify_api_key', $_POST['webpurify_api_key']);
    }
    // ... more options saved without verification
}
```

### SECURE CODE (After):
```php
function webpurify_save_options() {
    // Security check #1: Verify user permissions
    if (!current_user_can('manage_options')) {
        wp_die(__('You do not have sufficient permissions to access this page.'));
    }
    
    // Security check #2: Verify nonce (CSRF protection)
    if (!isset($_POST['webpurify_nonce']) || 
        !wp_verify_nonce($_POST['webpurify_nonce'], 'webpurify_save_options')) {
        wp_die(__('Security check failed. Please try again.'));
    }
    
    // Now safely process the form
    if (isset($_POST['webpurify_api_key'])) {
        $api_key = sanitize_text_field($_POST['webpurify_api_key']);
        update_option('webpurify_api_key', $api_key);
    }
    // ... properly sanitized options
}
```

---

## Implementation Steps

### Step 1: Backup Your Current File
```bash
cp webpurifytextreplace-options.php webpurifytextreplace-options.php.backup
```

### Step 2: Apply the Patch

Replace the vulnerable `webpurify_save_options()` function with the patched version.

**Key changes needed:**
1. Add capability check at the beginning of `webpurify_save_options()`
2. Add nonce verification after capability check
3. Add `wp_nonce_field()` to the options form
4. Ensure all inputs are sanitized using `sanitize_text_field()`

### Step 3: Test the Fix

1. **Test as admin:** Should work normally
2. **Test as logged-out user:** Should be blocked with permission error
3. **Test CSRF:** Try submitting form without nonce - should fail
4. **Test with subscriber account:** Should be blocked

### Step 4: Update Plugin Version

Update the plugin version number in the main plugin file header:
```php
/*
Plugin Name: WebPurify Profanity Filter
Version: 4.0.3
*/
```

---

## Additional Security Best Practices

### 1. Input Sanitization
Always sanitize user input:
```php
$api_key = sanitize_text_field($_POST['webpurify_api_key']);
```

### 2. Output Escaping
When displaying saved options:
```php
echo esc_attr(get_option('webpurify_api_key'));
```

### 3. Validate Against Whitelist
For select fields, validate against allowed values:
```php
if (in_array($replace_method, array('stars', 'custom'))) {
    update_option('webpurify_replace_method', $replace_method);
}
```

### 4. Use Proper WordPress Functions
- `update_option()` - safely saves settings
- `get_option()` - retrieves settings
- `sanitize_text_field()` - cleans text input
- `esc_attr()` - escapes HTML attributes
- `wp_die()` - proper error handling

---

## Testing Checklist

- [ ] Backup original file
- [ ] Apply security patches
- [ ] Test as administrator - can save settings
- [ ] Test as non-admin user - blocked from saving
- [ ] Test while logged out - blocked from accessing page
- [ ] Test form submission without nonce - fails security check
- [ ] Verify all settings save correctly
- [ ] Check for PHP errors in debug.log
- [ ] Test on staging environment first
- [ ] Deploy to production after successful testing

---

## WordPress Security Resources

- [WordPress Plugin Handbook - Security](https://developer.wordpress.org/plugins/security/)
- [Data Validation](https://developer.wordpress.org/plugins/security/data-validation/)
- [Securing Input](https://developer.wordpress.org/plugins/security/securing-input/)
- [Securing Output](https://developer.wordpress.org/plugins/security/securing-output/)
- [Nonces](https://developer.wordpress.org/plugins/security/nonces/)

---

## Questions or Issues?

If you encounter any issues implementing this fix:

1. Check WordPress debug logs: `wp-content/debug.log`
2. Verify PHP version compatibility (PHP 7.4+ recommended)
3. Ensure WordPress is updated to latest version
4. Test in safe mode with other plugins disabled

---

## Summary

This patch fixes CVE-2026-0572 by adding two critical security layers:

1. **Authentication** - Only admins can access the function
2. **Authorization** - Nonce verification prevents CSRF attacks

These are fundamental WordPress security practices that should be present in all admin functions that modify data.

**Deploy this fix immediately** to protect your WordPress site from unauthorized configuration changes.