Ecwid Ecommerce Shopping Cart < 6.12.5 - Arbitrary Plugin Settings Change via CSRF

2023-12-0500:00:00

Krzysztof Zając (CERT PL)

200

ecwid ecommerce

arbitrary change

csrf

ajax actions

plugin vulnerability

6.7 Medium

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.1%

JSON

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

http://vulnerable-site.tld/wp-admin/admin-ajax.php?action=ecwid_storefront_set_page_slug&slug=hehehehe

Besides, you can disable the store via the ecwid_storefront_set_status action.

The list of affected AJAX actions include:

- ecwid_storefront_set_status
- ecwid_storefront_set_store_on_front
- ecwid_storefront_set_display_cart_icon
- ecwid_storefront_set_page_slug
- ecwid_storefront_set_mainpage
- ecwid_storefront_create_page
- ecwid-save-spw-params