Urgent: Auto Post Scheduler <= 1.84 — CSRF → Stored XSS (CVE‑2026‑1877) — What WordPress Site Owners Must Do Now

A medium‑severity vulnerability (CVE‑2026‑1877, CVSS 7.1) affects the Auto Post Scheduler WordPress plugin (versions ≤ 1.84). The flaw allows a Cross‑Site Request Forgery (CSRF) that results in stored Cross‑Site Scripting (XSS) within the plugin’s options handling (aps_options_page). In short: an attacker can cause JavaScript to be written into plugin options and later executed in an administrative context or wherever those options are rendered. That execution can lead to site compromise if administrators are targeted.

This advisory—prepared by security practitioners in Hong Kong—explains the issue, practical abuse scenarios, how to detect compromise, and immediate mitigation steps you can implement while waiting for an official plugin patch.

Executive summary (TL;DR)

• Affected software: Auto Post Scheduler plugin (WordPress) — versions ≤ 1.84.
• Vulnerability type: CSRF enabling stored XSS via the plugin options page (aps_options_page).
• CVE: CVE‑2026‑1877
• Severity: Medium (CVSS 7.1)
• Exploitability: Requires tricking a privileged, logged‑in user (typically an admin). An attacker can host the exploit page externally; the victim must be authenticated and visit the attack page.
• Risk: Stored XSS in admin context can lead to full site takeover — create admin accounts, install backdoors, exfiltrate data.
• Immediate actions: Deactivate the plugin if feasible. If not, apply targeted WAF rules, rotate admin credentials, and scan for injected scripts.

What exactly is the vulnerability?

The plugin exposes an options handler (aps_options_page) that accepts POSTed option values which are stored without adequate CSRF verification and without sanitizing or escaping output when rendered. Specifically:

• No proper nonce or missing capability checks are enforced on the state‑changing request.
• Input stored in options is later rendered without safe escaping, enabling persistent XSS.
• Because execution can occur in admin pages, the attacker gains high‑privilege JavaScript execution.

This creates a CSRF → stored XSS chain: an attacker forges a request that writes malicious content into options; later viewing of those options executes the payload.

Attack flow (how an attacker abuses this)

1. Attacker hosts a webpage that issues a POST to the target WordPress site’s aps_options_page with fields containing JavaScript payloads.
2. Attacker tricks an administrator (or another privileged user) into visiting the malicious page while logged in.
3. The admin’s browser automatically submits the POST using active cookies; the plugin stores the malicious input.
4. When an admin later views the plugin settings (or elsewhere the option is rendered), the stored script executes in that admin’s browser.
5. The script performs privileged actions (create users, install plugins, modify files) or exfiltrates data.

Note: The attacker does not need to be authenticated to host or send the malicious page — only the victim must be logged in with sufficient privileges.

Realistic impact scenarios

• Administrator session compromise (cookie theft or XHR actions using admin privileges).
• Silent creation of a new administrator account and loss of access.
• Installation of backdoor plugins or theme modifications to persist access.
• Exfiltration of user lists, configuration, or other sensitive data.
• Delivery of malware, SEO spam, or visitor redirects.

Stored XSS inside admin pages is high‑impact because it effectively hands the attacker the admin’s capabilities via the browser.

How to check if your site is vulnerable or already compromised

1. Plugin version check:
   • Admin UI: Plugins → Installed Plugins → Auto Post Scheduler. If version ≤ 1.84, assume vulnerable.
   • WP‑CLI: wp plugin get auto-post-scheduler --field=version
2. Inspect stored options:
   • Look in the wp_options table for option names containing “aps”, “auto_post_scheduler”, etc.
   • Example query:

     SELECT option_name, option_value FROM wp_options WHERE option_name LIKE '%aps%' OR option_name LIKE '%auto_post%';

   • Search for , onerror=, or javascript: in option values.
3. Check plugin settings and public output:
   • Open the plugin options page as admin and view the page source for injected script tags or inline event handlers.
   • Search backups and exported options for injected payloads.
4. Logs:
   • Review webserver and access logs for suspicious POSTs to admin endpoints and unusual Content‑Type or payloads.
5. Indicators of compromise:
   • Unexpected administrator accounts.
   • New or modified plugins/themes you did not install.
   • Unusual outbound traffic or cron jobs.
   • Spam content or SEO injections.

// mu-plugin emergency patch: prevent unauthenticated CSRF updates to APS options
add_action( 'admin_init', function() {
    if ( ! empty( $_POST ) && isset( $_POST['action'] ) && $_POST['action'] === 'aps_update_options' ) {
        // Require current_user_can check
        if ( ! current_user_can( 'manage_options' ) ) {
            wp_die( 'Insufficient permissions.' );
        }
        // Verify nonce - plugin should include its own nonce name if available
        if ( ! isset( $_POST['aps_nonce'] ) || ! wp_verify_nonce( $_POST['aps_nonce'], 'aps_save_options' ) ) {
            wp_die( 'Security check failed.' );
        }
        // Quick sanitization example:
        foreach ( $_POST as $key => $val ) {
            if ( is_string( $val ) ) {
                $_POST[ $key ] = wp_kses( $val, array( 'a' => array( 'href' => array(), 'title' => array() ) ) );
            }
        }
    }
}, 1 );

-- Search options for script tags
SELECT option_name, option_value
FROM wp_options
WHERE option_value LIKE '%