WordPress W3 Total Cache Plugin < 2.8.2 Missing Authorization Vulnerability

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:boldgrid:w3_total_cache";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.127837");
  script_version("2025-01-21T05:37:33+0000");
  script_tag(name:"last_modification", value:"2025-01-21 05:37:33 +0000 (Tue, 21 Jan 2025)");
  script_tag(name:"creation_date", value:"2025-01-20 09:10:45 +0000 (Mon, 20 Jan 2025)");
  script_tag(name:"cvss_base", value:"7.5");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:S/C:C/I:P/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-01-14 07:15:26 +0000 (Tue, 14 Jan 2025)");

  script_cve_id("CVE-2024-12365");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("WordPress W3 Total Cache Plugin < 2.8.2 Missing Authorization Vulnerability");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_wordpress_plugin_http_detect.nasl");
  script_mandatory_keys("wordpress/plugin/w3-total-cache/detected");

  script_tag(name:"summary", value:"The WordPress plugin 'W3 Total Cache' is prone to a missing
  authorization vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"It is possible for authenticated attackers, with
  Subscriber-level access and above, to obtain the plugin's nonce value and perform unauthorized
  actions, resulting in information disclosure, service plan limits consumption as well as making
  web requests to arbitrary locations originating from the web application that can be used to
  query information from internal services.");

  script_tag(name:"affected", value:"WordPress W3 Total Cache plugin version prior to 2.8.2.");

  script_tag(name:"solution", value:"Update to version 2.8.2 or later.");

  script_xref(name:"URL", value:"https://www.wordfence.com/threat-intel/vulnerabilities/id/196e629f-7c77-4bcb-8224-305a0108b630");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if( ! port = get_app_port( cpe: CPE ) )
  exit( 0 );

if( ! infos = get_app_version_and_location( cpe: CPE, port: port, exit_no_version: TRUE ) )
  exit( 0 );

version = infos["version"];
location = infos["location"];

if( version_is_less( version: version, test_version: "2.8.2" ) ) {
  report = report_fixed_ver( installed_version: version, fixed_version: "2.8.2", install_path: location );
  security_message( port: port, data: report );
  exit( 0 );
}

exit( 99 );